Legal

Subprocessors

Everyone who may touch customer data, named. Subscribe to changes at [email protected] and we will tell you 30 days before this list changes.

Last updated 13 September 2026 · Protocol v9.3

In the default evidence mode (Mode 1) no subprocessor below receives raw customer data — the runner executes inside your perimeter and only hashes, booleans, counts and signatures leave. The rows marked Mode 2 / Mode 3 apply only when you authorise those modes.

Infrastructure and platform

SubprocessorWhat it doesData involvedLocation
Hosting providerRuns the site, the notary, the console and the immutable evidence storeAccount data; hashes, invariant status, nonces, signatures; console ratingsUnited States
Amazon Web Services (KMS, S3 Object Lock) Mode 2Per-tenant key custody and immutable storage of non-sensitive cryptographic artefacts; encrypted Mode 2 diagnosticsPseudonymised AST snippets and execution plans (Mode 2 only, 14-day TTL); hashes and signaturesUnited States (customer-selectable region on request)
Sigstore / Rekor transparency logPublic signature verification for signed runner buildsBuild signatures only; no customer dataPublic
Werify (werify.ai)Single sign-on and payment authorisation for the consoleAccount identifiers, email; no assurance contentUnited States
tao.ai OpsDBManaged database service for the consoleConsole records, when the database driver is enabledUnited States
StripeCard billing for the Baseline Assurance SprintBilling contact and payment details; no assurance contentUnited States
Google AnalyticsAggregate website analyticsSite usage, IP address; no assurance contentUnited States
Email deliveryTransactional and notification email, including recall noticesName, email, message contentsUnited States
SlackInternal alerting; shared channels with customers who want oneNotification metadata; anything a customer posts in a shared channelUnited States
AsanaWork tracking for reported issues, where a customer enables itIssue contentsUnited States

People

WhoWhat they doData involvedBound by
EvalQA triage staff Mode 2Diagnose an invariant failure from a sanitised exportPseudonymised AST snippet and execution plan, 14 daysEmployment confidentiality; access logged
Qualified reviewers (independent contractors) Mode 3Adjudicate INDETERMINATE and Sev-1 items on regulated schemas, inside the customer’s VDIWhat is visible on screen in the customer-controlled session; nothing transferredIndividual confidentiality agreement, identity verification, time-boxed and logged access, processing location recorded

Reviewers are the subprocessor that matters most for this service, so they are listed like any other. Before an engagement starts we tell you how many reviewers may be involved, their qualification tier and their processing location. How that access is controlled.

Not used

How this changes

We give 30 days’ notice before a new subprocessor starts processing customer data. If you object on reasonable data-protection grounds we work with you, and if we cannot resolve it you may terminate the affected service without penalty.


Also see security and data handling, the DPA, and the privacy policy.