Proveta subprocessors
These providers process customer personal data for Proveta. Each one has a data processing agreement with us.
Current subprocessors
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the website and API, scan and fix PR sandboxes, scheduled jobs, and cookieless web analytics | All service data while it is processed, including repository snapshots during scans | United States | Standard Contractual Clauses in the Vercel DPA |
| Neon | Postgres database | All stored service data | AWS US East, United States | Standard Contractual Clauses in the Neon DPA |
| Resend | Workspace invitations and risk expiry emails | Recipient email addresses, GitHub logins, workspace and repository names, and links | United States | Standard Contractual Clauses in the Resend DPA |
| Stripe | Payments, invoices, and taxes | Billing contact, business name, address, tax ID, and payment details | European Union and United States | Standard Contractual Clauses in the Stripe DPA |
Services you connect
GitHub is not our subprocessor. Your organisation chooses GitHub and connects it to Proveta. We read data from GitHub only under the permissions on the Security page.
Services that receive no personal data
- OSV (Google): Package names, ecosystems, and versions.
- FIRST.org EPSS: CVE identifiers, without the customer.
- Public package registries: Package names and versions to resolve dependencies.
We download the CISA Known Exploited Vulnerabilities catalogue and send nothing to CISA.
Changes
We email workspace admins at least 14 days before a new subprocessor starts to process customer personal data, and we update this page. You can object by email during that time. If we cannot resolve your objection, you can end the contract and we refund the unused part of any prepaid period.