Legal & trust
Subprocessors
Last updated 9 July 2026
The third parties that process data on our behalf to run this site. It's short by design — and it's observed, not asserted: it reflects what our code actually uses, not a generic vendor list. Because the GRC Solo product is federated, your operational security data never leaves your infrastructure, so no subprocessor ever touches it.
Active
Vercel Inc. ↗United States / global edge
Website hosting & content delivery (CDN)
Data: HTTP request metadata; IP address (transient, in logs)
Supabase, Inc. ↗United States — East US (Ohio), us-east-2
Storage of access-request / waitlist submissions
Data: The email address you submit (and nothing else)
Anthropic, PBC ↗United States
Site assistant (Claude API) — grounded on our published facts
Data: The messages you send the assistant (Anthropic does not train on API inputs)
Vercel Web Analytics ↗United States / global edge
Cookieless, no-PII traffic measurement
Data: Aggregate page views + a coarse hashed visitor signal — no cookies, no cross-site tracking
Want to be notified when this list changes? Ask via the privacy contact. Data-processing agreement (DPA) available to customers on request.