Subprocessors
The third-party providers that process data on behalf of Vendor Access Vault, with each one's purpose, the data it receives, and where it operates.
Each provider is listed with its function and the category of data it receives, nothing more.
Our core hosting, database, and monitoring providers operate from the United States.
Error monitoring receives diagnostic data with emails masked and IP removed; no session replay.
None of these providers is used for advertising or cross-context behavioral tracking.
Subprocessors
We use a limited set of third-party service providers to host, secure, monitor, and deliver Vendor Access Vault. We share with each provider only the data it needs for its function, and each is bound by its own privacy and security commitments. The table below lists every provider that processes personal data on our behalf, its purpose, the category of data it receives, and where it operates. We update this page when the list changes.
| Provider | Purpose | Data category received | Region |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and edge delivery; first-party cookieless product and performance analytics | Request data and application data in transit; account and organization content; page-view and web-vitals measurements | United States |
| Neon Inc. | Managed PostgreSQL database (primary datastore) | Account, organization, vendor, and credential records (credential secret values are encrypted before storage); audit and session records | United States |
| Upstash, Inc. | Rate limiting, account lockout, and ephemeral encrypted storage for the one-time-secret tool | IP address; account email address (for lockout); encrypted secret content | United States |
| Functional Software, Inc. (dba Sentry) | Error and performance monitoring (production only) | Diagnostic and error event data with personal data scrubbed before transmission (email addresses masked, IP address removed); no session replay or profiling | United States |
| Resend, Inc. | Transactional and security-notification email delivery | Recipient email address and message content | United States |
| Cloudflare, Inc. | CDN, DNS, web application firewall, and TLS termination for all traffic; Turnstile bot protection on account-security forms; cookieless web analytics | Request data transiting the network edge; IP address; bot-challenge signals; aggregate page-view measurements | United States and global edge network |
| Google LLC | Optional "Sign in with Google" authentication (only if you choose it) | Google account email, name, and account identifier | United States |
| Zoho Corporation | Inbound email handling for our contact and privacy-request addresses | Your name, email address, and the content of messages you send us | United States |
Changes and Notice
We may add, remove, or replace subprocessors as the Service evolves. When we do, we update this page. Account owners can request advance notice of material subprocessor changes by contacting us at the address below.
For how we use these providers and the rights you have over your data, see our Privacy Policy.