Subprocessors
Last updated 26 September 2026
These are the third parties that process personal data on our behalf. The list is short on purpose. Each one is under a contract that requires it to protect the data and to use it only to provide its service to us.
1.Current subprocessors
| Provider | What it does | What it receives | Scan data | Where |
|---|---|---|---|---|
| Vercel | Hosting, the global network that serves redirects, custom domains, bot protection, and cookieless web analytics | All service traffic, including account data and scan requests. Scan location is estimated from Vercel’s network data. | Yes | United States (application); global edge network (redirects) |
| Neon | Managed PostgreSQL, the primary database, hosted on Amazon Web Services | Everything we store: accounts, workspaces, codes, scan records, rate-limit records, and received email | Yes | United States (AWS us-east-1) |
| Resend | Sending transactional email, and receiving mail to our addresses, using Amazon SES | Recipients’ email addresses and message contents, including sign-in, invitation, alert, and digest email, abuse reports, and email sent to us | Aggregated scan figures in alert and digest emails | United States |
| Better Stack | Operational logs, error monitoring, uptime checks and job heartbeats | Application and request diagnostics forwarded by Vercel, including errors and request context; monitor and heartbeat status. Operational logs are retained for 3 days. | Scan-request diagnostics may be included; not the scan analytics database | Provider-managed telemetry and monitoring infrastructure |
| GitHub | Actions scheduling and encrypted disaster-recovery artifact storage | Encrypted account, workspace and code recovery snapshots retained for 30 days, plus workflow logs. Snapshots are encrypted on our own runner before upload; the private decryption key is kept outside GitHub. | No scan history in recovery snapshots | Provider-managed Actions and artifact infrastructure; snapshot preparation on our own US-based machine |
| Google Cloud (Web Risk) | Checking destination URLs against known malware and phishing lists | Destination URLs only. No account data and no scan data. | No | United States |
2.Independent providers
These providers receive data about you when you use them, but they do so as controllers in their own right rather than on our instructions, so they are not subprocessors:
- Stripe, including Link, sells our plans as merchant of record. It collects your name, email, billing address, and payment details, and shares with us only what we need to manage your plan.
- Google, if you choose to sign in with Google. It shares your name, email address, and profile image with us.
3.Changes to this list
We will update this page and email account owners at least 30 days before a new subprocessor starts handling customer personal data. If a provider has to be replaced urgently, for security or because it stopped its service, we will tell you as soon as we can instead. You may object on reasonable data protection grounds, as set out in the data processing addendum.
Questions: support@keeperqr.com.