Subprocessors
Last updated: 4 November 2026
Every company that processes personal data for Vigil, in one table: what it does for us, what it receives, which legal entity it is, where it processes, and how a transfer out of the European Economic Area is covered. The same list, from the same source, as section 12 of the Privacy Policy and section 6 of the Data Processing Addendum.
1.The list
Our database and authentication run with Supabase in Central EU (Frankfurt) (eu-central-1), which is where your account and your call records are stored at rest. The companies below each receive only what the third column says. Your prompts and the model's responses reach only Cloudflare, which runs the proxy and reads them in memory, and the AI provider you route to.
| Company | Purpose | Data it receives | Entity and location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database and authentication | Everything the Privacy Policy lists as stored: your account email and sign-in identity, every call record, detected errors, settings, API-key digests and the usage meter. Its own service logs hold your sign-in IP address and browser | Supabase Pte. Ltd., Singapore (support from Supabase, Inc., United States). Processes: Central EU (Frankfurt) · eu-central-1 | The database stays in Frankfurt. Where Supabase or its support staff reach the data from outside the EEA, the EU Standard Contractual Clauses in its DPA apply. Not in the EU-U.S. Data Privacy Framework: a Singapore company cannot self-certify |
| Resend | Sends account emails — confirming your email address, resetting your password, and telling you when your plan’s limit on money saved is near or reached | Your email address and the text of each account email, including its one-time link or the saved figure. Nothing from the proxy or your call data | Plus Five Five, Inc., United States. Processes: United States | EU-U.S. Data Privacy Framework (listed as Plus Five Five), with the EU Standard Contractual Clauses in its DPA as well. DPF entry |
| Cloudflare | Runs the proxy at api.vigil.tools and api.vigil.wtf | Your full request and response, in memory while the call is in flight, and the IP address of the machine making the call. Nothing is logged: Workers Logs and Logpush are off for the proxy | Cloudflare, Inc., United States. Processes: Global edge network | EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses (Modules 2 and 3) in its Customer DPA as well. DPF entry |
| Vercel | Hosts the dashboard at vigil.tools | The HTTP requests for the pages you load — your session cookie and IP address in transit. Function logs hold codes and counts, never an email or an id, and no log drain is configured | Vercel Inc., United States. Processes: Global edge network | EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses in its DPA as well. Vercel’s DPA covers its Pro and Enterprise plans. DPF entry |
| GitHub | OAuth sign-in, if you use it | That you signed in with GitHub; it returns your email, name and avatar to us | GitHub, Inc., United States. Processes: United States | GitHub states in its Privacy Statement that it complies with the EU-U.S. Data Privacy Framework and relies on the EU Standard Contractual Clauses otherwise |
| OAuth sign-in, if you use it | That you signed in with Google; it returns your email, name and avatar to us | Google LLC, United States. Processes: United States | Google LLC states that it is certified under the EU-U.S. Data Privacy Framework and relies on the EU Standard Contractual Clauses where required | |
| AI providers (Anthropic, OpenAI, Google, Mistral, and others) | Receive the requests you route through the proxy | Your full request, prompts included, and it sends back the response. Exactly what you would send it directly | The provider you address, under your own account with it. Processes: Determined by the provider you choose | On your instruction and under your agreement with that provider. Vigil is the conduit and does not choose the provider or the region |
| Stripe | Payments — subscriptions, invoices, and card details, which go to Stripe directly | Your email, billing name and address, VAT number if you give one, your subscription, and card details, which go to Stripe directly and never reach us | Stripe Payments Europe, Ltd., Ireland; data processed by Stripe, LLC, United States. Processes: United States / Ireland | EU-U.S. Data Privacy Framework (Stripe, LLC), with the EU Standard Contractual Clauses in Stripe’s Data Transfers Addendum as well. DPF entry |
| Plausible | Cookieless analytics on the public pages, if NEXT_PUBLIC_ANALYTICS_ID is set | That a public page was loaded, with no cookie and no stored IP address; that an account was created or a paid plan started, without a name or email | Plausible Insights OÜ, Estonia. Processes: European Union · Falkenstein, DE | None. An EU company processing on servers in the EU |
| Google Analytics | Visitor counts on the public pages — only if you accept analytics cookies, and only if NEXT_PUBLIC_GA_MEASUREMENT_ID is set | That a public page was loaded, its address, your browser and device type and the _ga identifiers; nothing at all if you decline analytics cookies | Google LLC, United States. Processes: United States (collected through servers in the EU) | Google LLC states that it is certified under the EU-U.S. Data Privacy Framework and relies on the EU Standard Contractual Clauses where required |
| PostHog | Visitor counts on the public pages — only if you accept analytics cookies, and only if NEXT_PUBLIC_POSTHOG_KEY and NEXT_PUBLIC_POSTHOG_HOST are set | That a public page was loaded, its address and title, your browser, device and the ph_ identifier, and your IP address as it reaches any server; nothing at all if you decline analytics cookies | PostHog, Inc., United States. Processes: European Union (PostHog is a United States company) | EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses (Module 2) in its DPA as well; the data is held in PostHog Cloud’s EU region. DPF entry |
| Advertising attribution on the public pages — only if you accept advertising cookies, and only if NEXT_PUBLIC_REDDIT_PIXEL_ID is set | That a public page was visited and, if you did, that you created an account or started a paid plan, tied to the _rdt_uuid identifier; no email, no name; nothing at all if you decline advertising cookies | Reddit, Inc., United States. Processes: United States | EU Standard Contractual Clauses under Reddit’s advertising terms. Reddit is not in the EU-U.S. Data Privacy Framework: its earlier Privacy Shield record lapsed on 10 March 2023 |
Hosted Vigil is not an EU-only service. The data at rest is in the EU; several of the companies that run the service are United States companies. Where a transfer out of the EEA happens, the last column says what covers it: the EU-U.S. Data Privacy Framework where the company is listed in it, and the European Commission's Standard Contractual Clauses (2021/914) in every case, as incorporated in that company's data processing terms. Reddit is not in the Data Privacy Framework, so its row rests on the Clauses alone.
2.How to read it
- Needed to run the service: Supabase, Cloudflare, Vercel, Resend and Stripe. You cannot use Vigil without them.
- Only if you use it: GitHub and Google receive a sign-in only when you sign in with them. The AI provider is the one you address, under your own agreement with it.
- Only with your consent: Google Analytics, PostHog and Reddit receive nothing before you accept the matching box in the cookie bar, and nothing at all if you decline. Plausible counts visits without a cookie and stores no IP address.
- Nothing else. There is no error tracker, no chat widget, no email-marketing tool and no log drain. If a company is not on this page, it does not receive personal data from Vigil.
3.When it changes
Section 6 of the Data Processing Addendum gives you 30 days' notice of a new sub-processor and the right to object. A new row appears here, in the Privacy Policy and in the Addendum in the same change, and the date at the top of this page moves with it. What each company receives, and what Vigil records in the first place, is in sections 3 to 6 of the Privacy Policy.