Subprocessors

Everyone who processes customer data on our behalf. If you are approving Libyears for a client, this is the list their administrator will ask for, and it is generated from the same file the application reads rather than maintained separately.

We notify customers before a new subprocessor begins handling their data. Everything below is in the United States; see security for what that means for transfers out of the EU and UK.

Processes your data

SupabaseUnited States (AWS us-west-2)

Postgres database, authentication, and the row-level security that separates tenantsSees: Everything stored: dependency inventories, scan history, account email addresses

VercelUnited States (iad1)

Application hosting and serverless executionSees: Request data in transit, and operational logs that exclude package names

InngestUnited States

Durable background jobs: scans, digests, deletion and billing sweepsSees: Job payloads, which carry repository identifiers and dependency inventories

GitHubUnited States

The source of what we read, via the GitHub App you installSees: Already yours. We read manifests and lockfiles; nothing is sent to GitHub

ResendUnited States

Transactional and digest emailSees: Recipient addresses and the contents of the emails we send you

Handles payment, not your repositories

As merchant of record, they collect billing details directly. Card numbers never reach this application, which is why there is no payment form anywhere in it.

Lemon SqueezyUnited States

Merchant of record: payments, invoicing, and sales taxSees: Billing name, email and payment details, which they collect directly

What is not on this list

No analytics provider, no session recording, no advertising network, and no AI vendor. The product sends nothing to a model, and the dashboard loads no third-party script.

The public data sources we read — the npm registry, OSV, and the rest — are not subprocessors, because none of them receives customer data. They are asked about public package names, and a private package name is never among them. They are listed on the attribution page.