Subprocessors
A security review asks who else touches the data. This list is the customer data plane, then the marketing tools that never see it.
Supplier data-processing terms are kept on file when the supplier publishes them. This page has no signed-status column. A column like that would read as a signature we are not publishing.
Regions are the provider's ordinary processing location. A single-region commitment is not offered here.
Customer data plane
| Company | What they do | What they receive | Where |
|---|---|---|---|
| Cloudflare | Compute, database, object storage, logs, and cookieless edge analytics | Scan metadata, account identity, workspace membership | Global edge |
| Clerk | Sign-in, organizations, and SSO | Name, email, workspace membership | United States |
| Tinybird | Analytics over scan and audit events | Scan metadata and workspace identifiers | EU or US |
| Resend | Transactional email for invitations and notifications | Name and email | United States |
| Amazon Web Services | Virtual machines for the remediation agent | Source code, when you ask the agent to write a fix | The region configured for that workspace |
| OpenAI | Scan analysis, and the remediation agent when that model is configured | Source-derived input for that analysis, and source when you ask for a fix | United States |
| Anthropic | Remediation agent, when that model is configured | Source, when you ask for a fix | United States |
| Remediation agent, when that model is configured | Source, when you ask for a fix | The provider's location | |
| DeepSeek | Remediation agent, when that model is configured | Source, when you ask for a fix | The provider's location |
| GitHub, GitLab, Bitbucket, Azure DevOps | Repository access when you connect one | Repository contents you grant | United States or EU. Azure DevOps follows the Microsoft region of the connected organization |
Marketing only
These process Vibgrate's own marketing data. They are not in the customer data plane.
| Company | What they do | What they receive | Where |
|---|---|---|---|
| Google Analytics | Traffic analytics for vibgrate.com | Page views, referrers, device and browser signals | Global |
| HubSpot | Marketing CRM | Name and email, if you give them to us | United States |
| X, LinkedIn, and Facebook | Distribution of posts we write | No customer data | The provider |
Questions about this list go to the privacy contact.
To hear when this list changes, email security@vibgrate.com and ask to be notified.