Legal & trust
Subprocessors
Last updated 21 August 2026
The third parties that process data on our behalf to run this site. It's short by design — and it's observed, not asserted: it reflects what our code actually uses, not a generic vendor list. Federate the GRC Solo product — the default — and your operational security data never leaves your infrastructure, so none of the subprocessors below ever touches it. A hosted install is the exception: it runs on infrastructure we operate, so ask us for its subprocessors before you choose it.
Active
Vercel Inc. ↗United States / global edge
Website hosting & content delivery (CDN)
Data: HTTP request metadata; IP address (transient, in logs)
Supabase, Inc. ↗United States — East US (Ohio), us-east-2
Storage of access-request / waitlist submissions
Data: The email address you submit (and nothing else)
Anthropic, PBC ↗United States
Site assistant (Claude API) — grounded on our published facts
Data: The messages you send the assistant (Anthropic does not train on API inputs)
Vercel Web Analytics ↗United States / global edge
Cookieless, no-PII traffic measurement
Data: Aggregate page views + a coarse hashed visitor signal — no cookies, no cross-site tracking
Resend (Plus Five Five, Inc.) ↗United States
Transactional email — the notification we send ourselves when you sign up, and the confirmation we send you
Data: The email address you submit, and any note you include — used to alert us and to send you a receipt at that address
Want to be notified when this list changes? Ask via the privacy contact. Data-processing agreement (DPA) available to customers on request.