Subprocessors
The third parties that process data on our behalf, and what each of them does.
Effective 17 August 2026Updated 17 August 2026
We give at least 30 days notice before adding or replacing a subprocessor. To be notified, email privacy@vibelock.ai and ask to be added to the subprocessor notice list.
Current subprocessors
- Railway
- Application hosting and infrastructure. Processes all data transiting the platform. United States, with EU region available on the Founder plan.
- Supabase
- Managed database and authentication. Stores account, project and security program data. United States or EU depending on region.
- Anthropic
- Large language model provider. Processes content submitted to AI features to return a result, which is then discarded. Does not train on submitted content. United States.
- Stripe
- Payment processing and subscription billing. Collects and processes payment card data directly. We never receive full card numbers. United States and EU.
- Resend
- Transactional and notification email delivery. Processes recipient email address and message content. United States.
What none of them receive
- Your API key, token or secret values. We never hold them, so we cannot pass them on.
- Your codebase. Local agent scans keep source on your machine and return only finding metadata.
- Full payment card numbers, which go directly from your browser to the payment processor.
Subprocessors · Effective 17 August 2026 · All legal documents