Subprocessors

Current subprocessors

Railway

Application hosting and infrastructure. Processes all data transiting the platform. United States.

Supabase

Managed database and authentication. Stores account, application, scan and finding data. United States.

Google Cloud

Runs the isolated code scanner and holds its signing keys. When you connect a repository, the code at one commit is processed in memory inside a scanner instance that is destroyed when the scan ends; the code is not stored. Processing and keys are in the europe-west1 region, in Belgium, in the European Union.

Anthropic

Large language model provider. Processes content sent to AI features to return a result. Does not train on it. May keep it for a limited period for safety and abuse monitoring under its commercial terms. We never send it your code. United States.

Stripe

Payment processing and subscription billing. Collects and processes payment card data directly. We never receive full card numbers. United States and EU.

Resend

Transactional and notification email delivery. Processes recipient email address and message content. United States.

What none of them receive

• Your API key, token or secret values. We never hold them, so we cannot pass them on.
• A stored copy of your code. There is no local agent. The hosted MCP server receives only results from your coding tool, never your code. A repository read processes the code at one commit only inside the isolated scanner described above, and discards it when the scan ends; no subprocessor stores it.
• Full payment card numbers, which go directly from your browser to the payment processor.

Services that are not our subprocessors

Some services you use alongside VibeLock act under their own terms, not on our behalf, so they are not on this list. Gumroad is the store through which we sell the Vibe Coding Security OS; it sells to you as merchant of record, processes your purchase and payment under its own terms and privacy policy, and makes your purchase details available to us. Notion hosts your copy of the Vibe Coding Security OS in your own workspace. Your repository host, your hosting provider and your coding tool are services you choose and connect. If you sign in with GitHub or Google, that provider confirms your identity to us under its own terms and privacy policy. If you turn on push alerts, your browser's push service delivers them under its own terms.