Sub-processors
Version 2026-08-05
Everyone who processes data on behalf of Sentris customers, what they process it for, and where. Under Art. 28(2) GDPR you may object to a new sub-processor — which only means something if you can tell when one was added, so this page is versioned and carries a changelog.
| Processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Hosting and serverless function execution; traffic and page-performance measurement (Web Analytics, Speed Insights) only after you opt in | Frankfurt (fra1), Germany — pinned in vercel.json | — (EU/EEA) |
| Supabase Inc. | Database — accounts, targets, scans, findings | Dublin, Ireland (eu-west-1) | — (EU/EEA) |
| GitHub, Inc. | Repository contents, read during a scan and not retained | United States | Standard Contractual Clauses |
| Anthropic PBC, via Vercel AI Gateway | AI Deep Scan — excerpts of the files under review, zero data retention | United States | Standard Contractual Clauses |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payments and subscription status | Ireland and United States | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Alert, account and sign-in email | United States | Standard Contractual Clauses |
| PostHog, Inc. | Product analytics — only after you opt in | Frankfurt, Germany (eu.posthog.com) | — (EU/EEA) |
Which of these see your code
3 of them: Vercel Inc., GitHub, Anthropic PBC. GitHub serves the files, Vercel executes the function that reads them, and the AI Deep Scan sends excerpts of the files under review to the model. Nothing is cloned and nothing is kept: file contents exist for the duration of a scan and are gone when it ends. What is stored is the findings, with any secret masked before it reaches the database.
The Deep Scan is the only path where code leaves our own infrastructure, it is configured for zero data retention, and it is optional. Run the four standard checks and no model is called at all.
Data residency
Application functions run in Frankfurt, pinned in vercel.jsonrather than left to a project default. The database is in Dublin. Product analytics, when you opt in, is on PostHog's Frankfurt instance. The remaining rows are US-based services under Standard Contractual Clauses, and each one is named above rather than described as “our infrastructure providers”.
Changes
- 2026-08-05 — Vercel Web Analytics and Speed Insights added for traffic and page-performance measurement, behind the existing analytics opt-in. No new subprocessor — Vercel already hosts the service.
- 2026-08-03 — First published.
Account holders are emailed before a new sub-processor starts processing, so the right to object under Art. 28(2) is exercisable rather than theoretical.
Sentris is evidence of technical measures taken. It is not evidence of GDPR compliance, and nobody selling a tool can issue that. See what the checks map to and the data processing agreement.