Subprocessors
ThirdProof uses the following third-party subprocessors to deliver the service. This page is maintained as required under our Terms of Service and applicable data protection regulations.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN & serverless compute | Request metadata, IP addresses, platform logs | US (global edge) |
| Supabase Inc. | Database, authentication & storage | Account data, assessments, reports, evidence, audit events | US |
| Anthropic PBC | AI narrative synthesis | Assessment evidence, which may include personal data of individuals associated with the assessed vendor | US |
| Resend Inc. | Transactional email | Recipient name, email address, message content | US |
| Stripe Inc. | Payment processing & billing | Billing contact, payment method, transaction records | US |
| Klaviyo Inc. | Marketing automation (free assessment funnel) | Lead email address, company domain, campaign attribution | US |
| Upstash Inc. | API rate limiting | IP addresses, API key identifiers, request counters | US |
| Cloudflare Inc. | Bot verification (Turnstile) | IP address, challenge metadata | US (global edge) |
| Microsoft Corp. | Clarity — session recording & heatmaps | Session replays, interaction behaviour, IP address | US |
| Plausible Analytics | Cookieless website analytics | Aggregated page views; no cookies or persistent identifiers | EU (Germany) |
| Google LLC | Analytics 4 & Ads conversion tracking | Pseudonymous identifiers, page & conversion events, click ID | US |
Assessment Data Sources
To perform an assessment, ThirdProof queries third-party public-data, registry and threat-intelligence services. These are not subprocessors of customer personal data, and are not listed above. Such queries contain only the assessed vendor's name and domain. No customer personal data, customer identity or account data is transmitted to any of them.
Where those services return information about individuals associated with an assessed vendor, ThirdProof acts as an independent controller for that publicly sourced data rather than as a processor acting on a customer's behalf. A categorised description of every source we use is published at thirdproof.ai/sources. The named provider roster is available to customers under NDA on request.
Change Notification Policy
ThirdProof provides at least 30 days written notice before adding or replacing a subprocessor that processes customer data. Active customers are notified via email. If you have questions about our subprocessors or data processing practices, contact privacy@thirdproof.ai.