Sub-processors
Version 2026-08-13
Everyone who processes data on behalf of Sentris customers, what they process it for, and where. Under Art. 28(2) GDPR you may object to a new sub-processor, which only means something if you can tell when one was added, so this page is versioned and carries a changelog.
| Processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Hosting and serverless function execution; traffic and page-performance measurement (Web Analytics, Speed Insights) only after you opt in | Frankfurt (fra1), Germany, pinned in vercel.json | none (EU/EEA) |
| Supabase Inc. | Database: accounts, targets, scans, findings | Dublin, Ireland (eu-west-1) | none (EU/EEA) |
| GitHub, Inc. | Repository contents, read during a scan and not retained | United States | Standard Contractual Clauses |
| OpenRouter, Inc. | AI Deep Scan: excerpts of the files under review. OpenRouter forwards each request to one of several third-party inference providers, and which one varies per request. The endpoints currently in use are free-tier endpoints, which may retain prompts and use them to train models | United States, plus the country of whichever inference provider a request is routed to | No data-transfer agreement in place |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payments and subscription status | Ireland and United States | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Alert, account and sign-in email | United States | Standard Contractual Clauses |
| PostHog, Inc. | Product analytics, only after you opt in | Frankfurt, Germany (eu.posthog.com) | none (EU/EEA) |
Which of these see your code
3 of them: Vercel Inc., GitHub, OpenRouter. GitHub serves the files, Vercel executes the function that reads them, and the AI Deep Scan sends excerpts of the files under review to the model. Nothing is cloned and nothing is kept: file contents exist for the duration of a scan and are gone when it ends. What is stored is the findings, with any secret masked before it reaches the database.
The Deep Scan is the only path where code leaves our own infrastructure, it is configured for zero data retention, and it is optional. Run the four standard checks and no model is called at all.
Data residency
Application functions run in Frankfurt, pinned in vercel.jsonrather than left to a project default. The database is in Dublin. Product analytics, when you opt in, is on PostHog's Frankfurt instance. The remaining rows are US-based services under Standard Contractual Clauses, and each one is named above rather than described as “our infrastructure providers”.
Changes
- 2026-08-13 · Correction. The AI Deep Scan row named Anthropic PBC via the Vercel AI Gateway with zero data retention. That was wrong: production routes both model stages through OpenRouter, Inc. on a free-tier endpoint, which may retain prompts for model training. The row now names OpenRouter and states the retention position accurately. No new processing was introduced by this change: it describes what was already happening. The rule checks never sent code to any model provider and still do not.
- 2026-08-05 · Vercel Web Analytics and Speed Insights added for traffic and page-performance measurement, behind the existing analytics opt-in. No new subprocessor: Vercel already hosts the service.
- 2026-08-03 · First published.
Account holders are emailed before a new sub-processor starts processing, so the right to object under Art. 28(2) is exercisable rather than theoretical.
Sentris is evidence of technical measures taken. It is not evidence of GDPR compliance, and nobody selling a tool can issue that. See what the checks map to and the data processing agreement.