Sub-processors
Last updated 2026-10-10
The list
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account records, project settings, aggregated measurements, uploaded logos | United States / EU (per project region) |
| Vercel | Application hosting and edge network | Request metadata in transit, including visitor IP addresses which are used to derive a country and are never stored by us | Global edge, United States |
| Resend | Transactional email (alerts, reports, account notices) | Recipient email address, message contents | United States |
| Anthropic | Writing the plain-English summary on a monthly report, on plans that include it | Aggregated performance figures and page URLs for the report. No visitor data, and nothing that identifies a person | United States |
| Google PageSpeed Insights / Chrome UX Report | Lab testing of a page and public field data for a domain | The page URL being tested. No visitor data is sent | Global |
| Dodo Payments | Checkout, subscriptions and invoicing, as merchant of record | Your billing name, email address and organisation name, which we send when you start checkout, and the payment details you enter on Dodo's own checkout page. We never see or store card details | Global — see Dodo Payments' privacy policy |
| Google Analytics | Measuring which pages of our own public website are useful | Pages viewed on this website, an approximate location, device and browser type, and a cookie identifier. Never anything from inside an account, and never your visitors' data | United States / Global |
What crosses a border, and what doesn't
Visitor IP addresses reach the edge network in the ordinary course of an HTTP request and are used there to derive a country. They are never written to our database and never reach any other provider on this list. What is stored is a two-letter country code alongside aggregated timings.
The testing API receives only the URL of a page being tested. No visitor data is sent to it.
Processing on your behalf
Where you are the controller of visitor measurement data and we are your processor, the terms of that processing are the ones in our agreement and privacy policy. We process it only to provide the service to you, we impose equivalent obligations on each provider above, and we will tell account holders by email before adding a new one.
If you need a signed data processing agreement for your own records, write to support@vitalsdesk.com and we will sign yours or send ours.