Sub-processors

Effective date: September 10, 2026

Every third party that processes customer data on GateTest's behalf, what each receives, where it is, and the terms that bind it. Providers that only run when you switch a feature on are listed separately.

1. About This List

A sub-processor is a company we engage to process personal data on our behalf in order to deliver the service — a database host, a payment processor, an AI provider. Each one is bound by a written data-processing agreement, receives only the data its function needs, and is listed here.

This page is the authoritative list for the purposes of our Data Processing Addendum and Privacy Policy, and it is the mechanism by which we give notice of changes. It is generated from the same record the application uses, so it cannot describe a provider we have quietly stopped using or omit one we have added.

Your git host, when it acts as your git host, is not our sub-processor: it processes your repositories on your instructions under your agreement with it. It appears below because we also read from and write to it on your behalf.

2. Core Sub-processors

Used for every customer as part of running the service.

Provider	Entity	Purpose	Data shared	Location	Terms
Anthropic	Anthropic, PBC	AI analysis and auto-fix generation	File contents, file paths and finding text for files being reviewed or fixed; prompts. Standard 30-day API retention; not used for model training under Anthropic's commercial terms.	United States	Terms
Stripe	Stripe, Inc.	Payments, subscriptions, billing portal	E-mail, payment card details (entered on Stripe-hosted pages, never on ours), tier, repository URL, module names and issue counts attached to the payment record.	United States	DPA
Neon	Neon, Inc.	Managed PostgreSQL database	Account e-mail and git-host login, repository URLs, scan findings (messages, file paths, line numbers), payment identifiers, API keys, audit log.	United States	DPA
Vultr	The Constant Company, LLC	Production servers	Everything processed by the application, including repository contents held on disk for the duration of a scan.	United States	DPA
Cloudflare	Cloudflare, Inc.	Domain registration and DNS	DNS queries for our domain. Traffic is not proxied through Cloudflare.	United States	DPA
GitHub	GitHub, Inc.	Git host, sign-in, GitHub App	Sign-in identity (login, e-mail), repository contents read for scanning, commit statuses, pull-request comments and auto-fix branches written back.	United States	DPA
Sentry	Functional Software, Inc.	Error monitoring and session replay	Error reports with request URL, headers and IP address; sampled browser session replays (10% of sessions, 100% of sessions with an error). Request bodies, source code, prompts, keys and cookies are scrubbed before sending.	United States	DPA

3. Important Sub-processors

Used when the feature is in your plan or connected — for example, when you connect a repository on an alternative git host, when we send you e-mail, or when you run a live-URL scan.

Provider	Entity	Purpose	Data shared	Location	Terms
Gluecron	Gluecron	Alternative git host	Push events, repository contents read for scanning, scan results written back. Only when you connect a Gluecron repository.	New Zealand / United States	Terms
Resend	Resend, Inc.	Transactional e-mail	Recipient e-mail address and message content (receipts, API keys, scan digests).	United States	DPA
Vapron	Vapron	Live-URL scanning dispatch	Target URL, scan id and suite for website / WordPress URL scans only. Never repository contents.	United States	Terms

4. Optional Sub-processors

Only when you turn the feature on. Nothing is sent to these providers by default.

Provider	Entity	Purpose	Data shared	Location	Terms
OpenAI	OpenAI, L.L.C.	Optional second-opinion consensus on Forensic-tier fixes	File contents and finding text for the files being fixed. Only when you opt in to consensus on a Forensic scan.	United States	DPA
Slack	Slack Technologies, LLC	Scan notifications to a webhook you supply	Scan summaries (repository, verdict, counts).	United States	DPA

5. Changes and Objections

Before, not after. We update this page before a new sub-processor receives any customer data, and we update the effective date at the top when we do.
Notification. E-mail hello@gatetest.ai with the subject "Sub-processor notifications" and we will e-mail you whenever this list changes.
Objection. If you have a reasonable data-protection ground to object to a new sub-processor, tell us within 30 days of the notice; the DPA sets out what happens next, including your right to terminate the affected service if we cannot resolve the objection.
Replacement. A sub-processor that is replaced or removed is deleted from this page; we do not keep former providers listed.

6. Contact

Questions about any provider on this list, or a request for a copy of the transfer terms we rely on: GateTest, hello@gatetest.ai.