Sub-processors
Who else can see your data
Everyone we rely on to run the hosted service, what they can reach, and what keeps the transfer lawful. We announce additions here at least 30 days before they start processing.
Vercel Inc.
their privacy terms- Purpose
- Application hosting, edge network, request logs
- Data reached
- IP address, request metadata, anything in a request body while it is being served
- Location
- United States, with edge processing in the region nearest the visitor
- Transfer basis
- EU Standard Contractual Clauses; UK Addendum
Google Ireland Ltd. / Google LLC (Firebase, Cloud Firestore, Firebase Authentication)
their privacy terms- Purpose
- Database, authentication, vector search
- Data reached
- Account e-mail and display name, workspace and project records, scan metadata, findings
- Location
- Firestore data is held in the configured region; authentication is global
- Transfer basis
- EU Standard Contractual Clauses; EU-US Data Privacy Framework
Model provider configured for the deployment (OpenAI, Google or an OpenAI-compatible endpoint)
their privacy terms- Purpose
- Analysis of derived scan signals
- Data reached
- Rule identifiers, repository-relative paths, line numbers, structure names and, only when the customer enables snippet sharing, masked one-line snippets
- Location
- Depends on the provider selected by the deployment
- Transfer basis
- Provider's data processing addendum; requests are sent with retention disabled where the provider supports it
Slack Technologies (optional)
their privacy terms- Purpose
- Delivering scan notifications, only when a workspace configures a webhook
- Data reached
- Finding titles, severities and a link to the report
- Location
- United States
- Transfer basis
- EU Standard Contractual Clauses
Running it yourself
The product is designed so that the list above can be shortened. Self-hosting the app removes our hosting and database from it, and pointing OPENAI_BASE_URL at a model you run yourself removes the model provider. The SDK never needs any of them: detection has always run on your machine.
Questions about a specific sub-processor: privacy@lawpatch.studio. See also the data processing addendum.