Who processes what
The ten third parties in our register, what each can access, and the one that holds a plaintext value in memory.
The register your Data Processing Agreement with us refers to. Our public copy is at /security/subprocessors.
Register
| Third party | Function | Access | Plaintext values |
|---|---|---|---|
| AWS KMS | Wraps the data key we seal your values with | Key material only | none |
| Neon | Our primary database | Ciphertext and metadata; we encrypt each value before it lands | none |
| Vercel | Application hosting and edge | Request routing, a coarse geo hint, and the compute that decrypts a value to serve it | in memory |
| Google Analytics | Page visit counts, only after you accept the cookie notice | Page paths, a truncated IP address, browser details | none |
| Resend | Transactional email | Recipient address, subject, message body | none |
| Upstash | Rate-limit counters and job locks | A counter and a key derived from an account or source IP | none |
| Sentry | Error reports | Error details with account and workspace identifiers, and a masked replay if you accept the cookie notice; never a value, token, password, request body or IP | none |
| GitHub | Copies of error reports, as tickets in a private repository | The same error details | none |
| Stripe | Payments, default processor | Billing and payment data | none |
| Paystack | Payments in African markets | Billing and payment data | none |
Plaintext in memory
Vercel runs the compute that decrypts a value to serve it, so plaintext exists there in memory for one request. See what we can see.
Unset terms
We have not yet set the notice period we give you before a new third party starts, or each third party's hosting region. Our privacy policy highlights every unset value. Confirm a region with us before you rely on it.
Values in a CI build
Where penv delivers values in your CI job, the four limits penv cannot remove, our credential lifetimes, trigger rules, SHA pinning and single audience.
Compliance posture
Our compliance status as of 24 September 2026: certification, enforced controls, audit retention, and unset legal values.