Sub-processors
Last updated 2026-10-17
These providers process personal data on our behalf. We tell account owners by email at least 30 days before adding a new one.
| Provider | What for | Where | Transfer mechanism |
|---|---|---|---|
| netcup GmbH | The server that runs TestWatch: database, test browsers, files | Vienna, Austria (EU) | EU — none needed |
| Cloudflare, Inc. | Network, website hosting (Workers), artifact storage (R2), email delivery, test email inboxes, access control, bot protection on sign-up forms (Turnstile), web analytics | Global network; R2 storage in Eastern Europe (location hint, not an EU jurisdiction guarantee) | EU–US Data Privacy Framework |
| Vercel, Inc. (AI Gateway) | Routes requests to the AI providers below. Keeps no prompts or outputs (zero data retention) | United States | EU–US Data Privacy Framework |
| Google LLC (Gemini on Google Cloud Vertex AI) | The AI model for every step: writing tests, explaining failures and proposing fixes. Only through Vertex AI, with zero data retention and no training on your data | United States / global Google Cloud regions | EU–US Data Privacy Framework |
| TypeSafe AI (Jev) | Fast first check of whether a failed run is a real bug, and of a new test’s checks. Zero data retention, no training | Not published by the provider | Standard contractual clauses (verification pending) |
| DigitalOcean, LLC | Serves the Jev model for TestWatch when the AI Gateway picks it. Zero data retention | United States | EU–US Data Privacy Framework |
| Stripe Payments Europe, Ltd / Stripe Technology Europe, Ltd | Payment processing | Ireland (EU); Stripe group in the United States | EU–US Data Privacy Framework / standard contractual clauses |
| Sold through Link, LLC (Stripe) | Merchant of record for payment and indirect tax: charges, receipts and invoices, VAT, refunds | United States | EU–US Data Privacy Framework / standard contractual clauses |
| PostHog, Inc. (EU Cloud) | Website page counts (cookieless) and a few account events | EU | EU — none needed |
| Google LLC (Sign in with Google) | Optional sign-in, only if you choose it: we receive your email address and your Google account ID. No password; we store no Google tokens | United States | EU–US Data Privacy Framework |
| GitHub, Inc. (Sign in with GitHub) | Optional sign-in, only if you choose it: we receive your email address and your GitHub account ID. No password; we store no GitHub tokens | United States | EU–US Data Privacy Framework |
| Your Slack workspace / webhook endpoint | Only if you configure it: receives the notifications you choose | Chosen by you | Your choice of destination |
AI requests go through the Vercel AI Gateway, pinned to the providers named above — Gemini only through Google Vertex AI, Jev only through TypeSafe AI or DigitalOcean. Each has a zero-data-retention agreement with the gateway and doesn’t train on your data. AI requests are not pinned to an EU region.
What the AI models receive is described on the security page: your description and scrubbed page snapshots while a test is written, and scrubbed error text and a page snapshot when a run fails. Passing runs send nothing.