Subprocessors
Services that process personal data on our behalf.
Last updated: October 9, 2026
These third-party services help us operate XploitScan. Each has its own privacy policy. The same list, with more detail on what we send and why, is in Privacy Policy §7.
| Service | What it processes | Location |
|---|---|---|
| Clerk | Authentication and user management (email address and profile information). | United States |
| Stripe | Payment processing for paid subscriptions. Receives payment information directly. | United States |
| Database hosting provider | Application data (account info, scan metadata, results, team data). Source code is never stored here. | United States |
| Application hosting provider | Web application hosting and standard server logs (IP addresses and request data). | United States |
| Brevo | Transactional, onboarding, and occasional product emails (recipient address and email content). | France |
| Tally | If you answer a survey we send, it receives your answers and a random response token. It does not receive your name or email. | EU (data stored in Europe) |
| Error monitoring service | Browser information, IP addresses, and error stack traces. Not your source code. | United States |
| Product analytics provider (PostHog) | With consent: page views, product events, browser user agent, and if you are signed in, account ID and email. Anonymous operational events as described in the Privacy Policy. | United States |
| Anthropic | When AI-powered features are enabled, excerpts of source code around scan findings, and questionnaire questions and answers you submit for AI scoring. | United States |