'%20d='m0%200%2018%2011h65%2065%2065%2065%2066L51%2039h65%2065%2065%2065L18%2066h65%2065%2065%2065%2066L51%2094h65%2065%2065%2065L18%20121h65%2065%2065%2065%2066L51%20149h65%2065%2065%2065L18%20177h65%2065%2065%2065%2066L51%20205h65%2065%2065%2065L18%20232h65%2065%2065%2065%2066z'/%3e%3c/svg%3e){kind=small}
'%3e%3cpath%20fill='%23fff'%20d='M619.4%20512H-112V0h731.4z'/%3e%3cpath%20fill='%230038b8'%20d='M619.4%20115.2H-112V48h731.4zm0%20350.5H-112v-67.2h731.4zm-483-275%20110.1%20191.6L359%20191.6z'/%3e%3cpath%20fill='%23fff'%20d='m225.8%20317.8%2020.9%2035.5%2021.4-35.3z'/%3e%3cpath%20fill='%230038b8'%20d='M136%20320.6%20246.2%20129l112.4%20190.8z'/%3e%3cpath%20fill='%23fff'%20d='m225.8%20191.6%2020.9-35.5%2021.4%2035.4zM182%20271.1l-21.7%2036%2041-.1-19.3-36zm-21.3-66.5%2041.2.3-19.8%2036.3zm151.2%2067%2020.9%2035.5-41.7-.5zm20.5-67-41.2.3%2019.8%2036.3zm-114.3%200L189.7%20256l28.8%2050.3%2052.8%201.2%2032-51.5-29.6-52z'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Subprocessors
The third parties that process personal data on behalf of Vaktex, what they do, and where they are.
1. What a subprocessor is
A subprocessor is a third party that Vaktex engages to process personal data as part of providing the Services. This page lists every subprocessor we use, including those that process Customer Content on your behalf under our Data Processing Addendum (the “DPA”), where this page forms Annex 4. Each subprocessor is bound by written data protection terms, and we remain responsible for its work.
2. Notice and objection
We give at least 30 days’ notice before a new subprocessor begins processing Customer Personal Data. We give notice by updating this page and by email to everyone who has subscribed to updates. Paid and enterprise customers with a DPA also receive notice at their account email.
You can object to a new subprocessor on reasonable data protection grounds by emailing support@vaktex.com within the 30-day notice period. We will work with you in good faith to resolve the objection. If we cannot, you may terminate the affected Service and we will refund any prepaid fees for the remainder of the term, pro rata. If we must replace a subprocessor urgently for security or service continuity reasons, we will give notice as soon as practicable, and your objection rights run from that notice. Section 8 of the DPA sets out the full terms.
3. Subscribe to updates
To receive an email when this list changes, email support@vaktex.com with the subject “Subprocessor updates”.
4. Infrastructure and hosting
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of vaktex.com, the Gateway, licence and notification services and VAKT cloud review (Workers, D1, R2, Queues, Durable Objects); CDN, DNS, DDoS protection, bot checks (Turnstile), aggregate web analytics | All Service traffic, IP address, account and licence data, waitlist, job applications and CVs, gateway session data (transient), Preview model turns kept for training (R2), anonymised VAKT cloud review code and code graphs kept for training (R2, D1), hashed limit counters (D1) | Global edge network; storage in the United States |
| Google LLC (Google Cloud Platform) | API services (Cloud Run), storage (Cloud Storage), sandbox VMs (Compute Engine), key management (Cloud KMS), vScan cooked analysis | Customer Content, scan data, sandbox files, uploaded transcripts, avatars | United States (us-central1 and the US multi-region); sandbox VMs in the United States or the European Union, as chosen for each sandbox |
| Neon, Inc. (Databricks) | Managed Postgres database | Account, authentication, billing references, licences, keys, organizations, scan records | United States (AWS us-east-1) |
5. AI model providers
AI model providers receive data only for the models you choose, or for a Service that relies on them. Each provider’s data retention, from none up to a maximum of 90 days, is shown per model in the Gateway API model listing. We use providers’ business and API terms, under which API inputs and outputs are not used to train their models by default. The only exception is a Preview model: the provider that runs one may train on the turns sent to it, where the model listing says so.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Fireworks AI, Inc. | Model inference (Gateway, scans) | Prompts, completions, code snippets | United States |
| Google LLC (Gemini API / Vertex AI) | Model inference (Gateway, scans, vScan cooked) | Prompts, completions, code snippets | United States; transient processing and caching may occur in other countries |
| Amazon Web Services, Inc. (Amazon Bedrock) | Model inference (Gateway) | Prompts, completions, code snippets | United States |
| Microsoft Corporation (Azure OpenAI / Azure AI Foundry) | Model inference (Gateway) | Prompts, completions, code snippets | United States |
| OpenAI, L.L.C. | Model inference (Gateway, scans) | Prompts, completions, code snippets | United States |
| Anthropic, PBC | Model inference (Gateway) | Prompts, completions, code snippets | United States |
| X.AI LLC (xAI) | Model inference (Gateway) | Prompts, completions, code snippets | United States |
| Mistral AI SAS | Model inference (Gateway) | Prompts, completions, code snippets | France (EU) |
| Hugging Face, Inc. | Model inference routing (Gateway) | Prompts, completions, code snippets | United States |
| Cloudflare Workers AI | Model inference (Gateway, VAKT cloud review) | Prompts, completions, code snippets | Global |
For the VAKT extension’s cloud review, Cloudflare Workers AI runs Vaktex cloud models on code that was anonymised on the user’s machine. Cloudflare R2 and D1 store the resulting training records (up to 24 months, with no user identifier) and short-lived limit counters, and Cloudflare Queues schedules the review of code graphs. See section 3.12 of our Privacy Policy.
6. Business operations
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments Europe | Payments, invoicing, tax | Billing contact, payment data, transaction history | United States / Ireland |
| Resend, Inc. | Transactional email (sign-in codes, password reset, notifications) | Email address, message content | United States |
| Twilio Inc. | Phone verification (when enabled) | Phone number | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Error diagnostics, URLs, device and browser; user information and IP headers are stripped. Session replay runs only with analytics consent. | European Union (Germany) |
| PostHog, Inc. | Product analytics, server-side product events | Pseudonymous user id and events, if usage metrics is on; with consent, page views, email, name and replays | United States |
7. Website analytics
These vendors receive data only from website visitors who accept optional cookies. If you decline, or your browser sends a Global Privacy Control signal, their scripts do not load. See our Cookie Policy.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website analytics and advertising measurement | Cookie ids, page views, device, approximate location | United States |
| Amplitude, Inc. | Website analytics and session replay | Cookie ids, page views, device, approximate location, session replays | United States |
| Mixpanel, Inc. | Website analytics, session recording, heatmaps | Cookie ids, page views, device, approximate location, session recordings | United States |
8. International transfers
For subprocessors in the United States, we rely on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework where the subprocessor is certified, and otherwise on the EU Standard Contractual Clauses and, for the UK, the UK Addendum. Section 11 of the DPA has the details.
9. Changes
| Date | Change |
|---|---|
| 2026-10-09 | First published |
| 2026-10-11 | Cloudflare Workers AI, R2, D1 and Queues added for VAKT extension cloud review |