This page is the canonical public vendor and data-flow register for services that help operate Verifex and for independent public data sources contacted by product features. Not every listed external party is a subprocessor. Where a transfer, DPA, effective-date or legal-role detail is not yet confirmed, the relevant cell states that it is under review or not recorded.
| Vendor | Purpose | Role | Data category | Region | Transfer | Privacy policy | DPA | Effective | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|
| Cloudflare, Inc. | CDN, reverse proxy and DDoS protection for verifex.dev and api.verifex.dev | Service provider processing request content in transit; TLS terminates at its edge | Request content in transit, including screened names submitted to the screening API | United States / global edge | SCCs (under review) | Policy | Available | Not recorded | 2026-10-13 |
| Hetzner Online GmbH | Hosting (EU VPS) | Service provider processing application data | All app data at rest | Germany/Finland (EU) | EU (no transfer) | Policy | Available | Not recorded | 2026-10-07 |
| Lemon Squeezy LLC | Payments / billing | Payment provider; controller/processor allocation under review | Customer email, subscription data | United States | SCCs (under review) | Policy | Available | Not recorded | 2026-10-07 |
| Resend (Plus Five Five, Inc.) | Transactional email | Service provider processing transactional email data | Recipient email, message content (monitoring alerts include the watched name and its closest list match) | United States | SCCs (under review) | Policy | Available | Not recorded | 2026-10-07 |
| Hostinger International Ltd | Email (SMTP/IMAP), including quota notices and business outreach email | Service provider processing operational mailbox data | Recipient email and message content, including business contact details for outreach; inbound email content received at operational inboxes (may include support messages) | Lithuania/EU | EU | Policy | Under review | Not recorded | 2026-10-07 |
| Anthropic PBC | Optional AI: adverse-media headline classification (opt-in, Growth plan and above) | Optional service provider; data-processing terms under review | Screened name and aliases, entity type, country and industry; article headlines, websites and dates | United States | SCCs / commercial API terms (under review) | Policy | Available (commercial) | Not recorded | 2026-10-07 |
| The GDELT Project | Optional adverse-media news retrieval (opt-in, used with the adverse-media feature) | Independent public data source; subprocessor classification under legal review | Screened entity name, submitted as a news-search query | United States | Under review | Policy | Under review | Not recorded | 2026-10-07 |
| UK Companies House | Optional UK company (KYB) lookup (opt-in, paid plans) | Independent public registry; not presented as a Verifex subprocessor | Company name / registration number submitted for KYB | United Kingdom | UK (adequacy) | Policy | Public registry | Not applicable | 2026-10-07 |
| Sentry (Functional Software, Inc.) | Browser error monitoring for the public site and dashboard, and server error monitoring for the web app and API | Optional service provider for scrubbed error telemetry | Error type + stack location, and sampled performance timings by route; Sentry is configured to minimize and redact customer data (request body/query/URL, user, breadcrumbs, contexts, tags, exception messages, cookies and credentials are dropped or redacted before sending) | United States | SCCs (under review) | Policy | Under review | Not recorded | 2026-10-07 |
| Slack Technologies | Incident alerting (optional) | Optional service provider for technical error metadata | Technical error metadata | United States | SCCs (under review) | Policy | Under review | Not recorded | 2026-10-07 |
| Better Stack | Uptime monitoring and the public status page (status.verifex.dev) | Service provider for availability monitoring | Availability checks of public endpoints; the email address of anyone who subscribes to status updates | Under review | Under review | Policy | Under review | Not recorded | 2026-10-07 |
Change notice
We give 30 days' notice of new subprocessors where contractually required, so that customers can review and, where their agreement provides for it, object.
Data residency
Primary application data is hosted in the European Union. Some optional and operational providers are located in the United States or operate internationally, as shown above. Verifex does not currently offer data residency outside the EU.
Not legal advice. This page is provided for transparency and may change as our infrastructure evolves. Related pages: Privacy, GDPR, DPA, and Security.