Subprocessors
These are the companies that handle data for us. We keep this list current. We will tell you before we add one.
Last updated
Most of them only see metadata
Package names, versions, findings, scores. That is all that leaves your machine when you scan. So that is all any of these companies can hold.
Three of them can see your code
AWS and OpenAI, when you ask the agent to write a fix. Your Git host, when you connect a repository. None of it happens unless you ask.
The register
| Company | What they do for us | What they receive | Where |
|---|---|---|---|
| Cloudflare | Compute, database, object storage, and cookieless edge web analytics | Metadata Scan metadata, account identity, workspace membership | Global edge |
| Clerk | Sign-in, organizations, SSO | Identity Name, email, workspace membership | United States |
| Tinybird | Analytics over scan and audit events | Metadata Scan metadata, workspace identifiers | EU (GCP europe-west2) |
| Resend | Transactional email — invitations and notifications | Identity Name, email | United States |
| Amazon Web Services | Virtual machines for the remediation agent | Source code Your source code, when you ask the agent to write a fix | Per workspace residency |
| OpenAI | The model behind the remediation agent and scan analysis | Source code Source-derived input, when you ask the agent to write a fix | United States |
| GitHub, GitLab, Bitbucket | Repository access, when you connect one | Source code Repository contents you grant access to | US / EU |
Our own marketing
These hold Vibgrate's marketing data, not your platform data. We list them so the picture is complete.
| Company | What they do for us | What they receive | Where |
|---|---|---|---|
| Google Analytics | Website traffic analytics for vibgrate.com (GA4) | Metadata Page views, referrers, approximate location, device/browser signals; first-party cookies (_ga, _ga_*) | Global (Google) |
| HubSpot | Marketing CRM | Identity Name, email — if you give them to us | United States |
Worth knowing
Marketing-site analytics. vibgrate.com uses Google Analytics 4 (first-party cookies such as _ga) and Cloudflare Web Analytics (cookieless edge metrics). Theme preference is stored in local storage. See the privacy policy for detail.
You can bring your own model key. Would you rather your code never reached our model provider? Add your own key and it goes to yours instead.
We are not claiming EU data residency. The routing is built. The storage is not switched on yet. Your data is in our primary region today, and we will change this page the day that changes.
Questions about a specific processor?
Write to privacy@vibgrate.com. Need a filled-in questionnaire? Ask. We will not make you book a call first.