Sub-processors

This page lists the outside services that receive personal data or customer content from the Verdifax service, what each one receives, why, and where. It supplements our Privacy policy. We will update this page when the list changes. [Pending review by counsel: which of these providers are sub-processors in the legal sense, as opposed to independent recipients such as the public Rekor log.]

Fly.io

Purpose: hosts our API, our database and our application logs.

Receives: everything the API receives, in readable form: payloads, AI output text, metadata, and request headers, including your IP address. Our database and our application logs are stored with Fly.io.

Where: Ashburn, Virginia, United States.

Cloudflare

Purpose: DNS, content delivery and hosting for verdifax.com, the dashboard and docs.verdifax.com; running our access request form and welcome email functions; Cloudflare Web Analytics; and bot detection.

Receives: all traffic to those sites, including your IP address; the contents of the access request form; the contents of the welcome email (your name, email address, organization and claim link); page-load measurements from the Web Analytics script; and what its bot-detection script collects from your browser, together with the cf_clearance cookie it sets. Our API at api.verdifax.com is not served through Cloudflare.

Where:Cloudflare's global network.

Anthropic

Purpose: the AI governance review, which is turned on in our hosted service.

Receives: the text you send in the ai_output_textfield, exactly as received, sent to Anthropic's Claude API. Nothing is sent when that field is empty.

Terms: Anthropic's published Commercial Terms state that Anthropic may not train models on customer content from its services. Anthropic describes how long it keeps API inputs and outputs in its own privacy center, and Anthropic can change that policy.

Where: we have not confirmed where Anthropic processes this data.

Sentry

Purpose: error diagnostics for our API.

Receives: when the API crashes, the request method, path and query string and the request headers, with credential headers, the client IP header and the user-agent header redacted and the request body removed. When the API logs an error, the error message and the tags attached to it. Error tags can include internal identifiers, such as Stripe customer ids.

Where: we have not confirmed whether our Sentry project stores data in the United States or the European Union.

Resend

Purpose: transactional email.

Receives: each access request notification sent to our inbox (all form fields, with your email address as the reply-to address), and each welcome email sent to you (your name, email address, organization and claim link).

Where: Resend sends our email through Amazon SES in the us-east-1 region, United States.

Google Workspace

Purpose: our company email for verdifax.com.

Receives: every access request notification, and any email you send to a verdifax.com address, including privacy@verdifax.com, legal@verdifax.com and access@verdifax.com.

Where: we have not confirmed where Google stores this mail.

AWS KMS

Purpose: key management for our record-erasure feature.

Receives: only the data-encryption keys that it wraps. It holds keys, not customer content or personal data.

Where: the us-east-1 region, United States.

Stripe

Purpose: payments.

Receives:the payment details you give to Stripe directly. Stripe sends our API signed event notifications, from which we store your Stripe customer id. Payment card data never reaches Verdifax's systems.

Sigstore Rekor public transparency log

Purpose: a public, append-only record that lets anyone check when a sealed record was anchored.

Receives:for each anchored run, a SHA-256 hash, a signature over that hash, and Verdifax's public key. It receives no raw personal data.

Note: entries in the log at rekor.sigstore.dev are public and permanent. No one can remove them.

Contact

Questions about this list can be sent to privacy@verdifax.com.