Subprocessors

Providers that hold or process information about a person or a firm

Each processes it only to provide its service to us, under its own contract and security terms.

Railway

Hosts our application, its database and its logs, so it holds everything they hold. Purpose: hosting.

Cloudflare

Every visitor request passes through its network. It stores one set of our encrypted database backups. With the owner's own token it writes the one record a customer approves on that customer's own zone. Purpose: delivery, protection of the site and backups.

GitHub

A second set of encrypted database backups, in a private repository of ours. Purpose: backups.

Stripe

The buyer's name, email address and card. The card goes straight to Stripe and never reaches our systems. Purpose: payments.

Resend

The recipient's name and address and the message: sign-in codes, deliveries, receipts and alerts to our desk. Purpose: transactional email.

Google Workspace

Our mailboxes, from which our people send and receive email. Purpose: email.

Google Cloud

A business name and city to find its website. Where switched on, the text of a public news article, or a firm's name, domain and city for the AI-answer read. Purpose: place search and one model family.

Google account connection

Only for a customer who connected a Google Workspace account to our former mailbox review: that account's settings. Raw data from a review is deleted 90 days after it completed. Purpose: the former mailbox review.

Microsoft

Our own Microsoft 365 mailboxes. For a customer who connected a Microsoft 365 account to our former mailbox review: that account's settings. Purpose: email and the former mailbox review.

Anthropic

A firm's public facts and stored findings, text from its own public pages, questions typed into an assistant and email that reaches our mailboxes when the inbox agent sorts it. The AI Impersonation Check also asks it about a firm. Purpose: the Claude models behind our summaries, reviews and assistants.

OpenAI

The AI Impersonation Check asks it what it answers about a firm. It receives the firm's name, domain and city, never a person. It is called only where a key is set. Purpose: the AI Impersonation Check.

Microsoft (Azure AI with Bing search)

The AI Impersonation Check asks it what it answers about a firm. It receives the firm's name, domain and city, never a person. It is called only where a key is set. Purpose: the AI Impersonation Check.

Perplexity

The AI Impersonation Check asks it what it answers about a firm. It receives the firm's name, domain and city, never a person. It is called only where a key is set. Purpose: the AI Impersonation Check.

xAI (Grok)

The AI Impersonation Check asks it what it answers about a firm. It receives the firm's name, domain and city, never a person. It is called only where a key is set. Purpose: the AI Impersonation Check.

Hunter

A firm's domain, or a person's name and work domain. Purpose: finding and checking a published work address.

FullEnrich

A person's name and the firm's domain, where switched on. Purpose: finding a work address.

LeadMagic

A person's name and the firm's domain, where switched on. Purpose: finding a work address.

Apollo

A firm's domain, where switched on. Purpose: finding who to write to at a firm.

MillionVerifier

An email address, to learn whether its mailbox accepts mail. Purpose: checking an address before we write to it.

Instantly

Business contact details, when our staff choose to use it. Purpose: some email campaigns.

Dropbox Sign

The signer's name and email address. Purpose: electronic signature.

Sentry

Error reports from our application, set not to send personal information by default. Purpose: error monitoring.

Slack

Notices to our own team, which can name a representative or an applicant. Purpose: internal notices.

Pushover

Notices to our own phones, which can name a firm. Purpose: internal notices.

Google (Gemini)

The AI Impersonation Check asks it what it answers about a firm and receives the firm's name, domain and city, never a person. Purpose: the AI Impersonation Check.

Sources we ask about the item being checked

Each receives the item being checked and nothing about the person who asked.

Serper

A firm's name or domain as a search. Purpose: web search.

Breach-data provider

A firm's domain, or an address at it, to learn whether it is listed in breach data. Purpose: breach data.

Registration-history providers

A domain or an organisation name, on a paid reading only. Purpose: who held a name before.

A search index of leaked material

A firm's domain. Purpose: leaked material that names the firm.

Phishing and malware lists

A web address or a host name. Purpose: whether a name is already listed.

A public web-security grading service

A domain. Purpose: its published grade of a site.

Domain, certificate and network records

A domain, a host name or a network address only. Purpose: the public records a reading is made of.

Providers that hold nothing about a customer

These hold our own evaluation set-ups: invented firms under our own accounts, never a real business.

Zoho Mail

Mailboxes of our own test set-ups, for invented firms only. Purpose: our own evaluation set-ups.

Domain registrars

Registrations of invented firms' names under our own accounts. Purpose: our own evaluation set-ups.

Hosting providers

One-page sites of invented firms under our own accounts. Purpose: our own evaluation set-ups.

Where they are

Most of these providers are in the United States. The breach-data provider is operated from Australia and Hunter from France.

Requests that go to a host that is not our vendor

A change to a customer's own DNS host, made only with the owner's token and consent, for the one record the owner approved.

A search on a public register's own search form, which creates nothing.

Changes to this list

We update this page at least 30 days before a new provider starts receiving a customer's personal information. Each change carries its date.

4 November 2026: the list is read from the hosts our code may write to and published.