Draft — this document has not yet been reviewed by qualified legal counsel and must not be relied upon. See docs/LEGAL_REVIEW_REQUIRED.md.
These providers process personal data on our behalf to run PeptideProof. Each is bound by a data-processing agreement and may use the data only on our instructions. See the Privacy Policy for how we use your data.
[confirm: this list must match the accounts actually configured in production — delete the providers you do not use, fill in the bracketed entries, and confirm each provider’s region]
Current subprocessors
Vercel Inc.
- Purpose
- Hosting of the website and API; request logs
- Data
- All data you submit through the site, IP address and request metadata
- Location
- United States / global edge network
Railway Corp.
- Purpose
- Hosting of the background worker that analyses documents, the primary database (PostgreSQL) and the job queue / rate-limit cache (Redis)
- Data
- Account data, document metadata, extracted text, evidence and verification results; uploaded documents while being processed; job identifiers and IP addresses used briefly as rate-limit keys
- Location
- [confirm the Railway region you select — e.g. EU West (Amsterdam) or US East]
Cloudflare, Inc.
- Purpose
- Object storage (R2) for uploaded files; DNS; inbound email forwarding for support addresses
- Data
- Uploaded files; DNS queries; support emails in transit
- Location
- [confirm the R2 jurisdiction/region selected]
Anthropic, PBC
- Purpose
- AI model that reads uploaded documents (text, and page images for scans and photos) and drafts explanations
- Data
- Document text and page images; structured evidence summaries
- Location
- United States
Stripe, Inc. / Stripe Payments Europe, Ltd.
- Purpose
- Payment processing and subscription billing
- Data
- Email, billing details and payment method (entered on Stripe's pages; we never see card numbers)
- Location
- United States / Ireland
Mailjet SAS (Sinch)
- Purpose
- Sending account and notification emails
- Data
- Recipient email address and the content of the email
- Location
- European Union
Google LLC
- Purpose
- Receiving and answering support and legal correspondence (Gmail)
- Data
- Whatever you include in an email to us
- Location
- United States / global
Changes
We will give advance notice before adding or replacing a subprocessor that handles uploaded documents: we update this page first, and Business customers can ask to be notified by email.
