Legal
Sub-processors
Last updated: September 29, 2026
The list
Who processes data for us
These are all the third parties that process personal data on our behalf. The Privacy Policy explains why we collect each kind of data, and the Data Processing Agreement covers the data you give us to check or fix.
| Name | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Managed Postgres database, authentication and file storage | Account records, scan data, remediation logs, OAuth tokens, uploads, screenshots and corrected files | United States |
| Railway | Hosting for our website, API, scanner, remediation worker, scheduler and mail service, with the Postgres database and Redis cache they use | Everything the Service processes is processed on these servers while a job runs; the Redis cache holds full-page screenshots for up to 30 minutes during a fix | Singapore |
| Stripe | Payments, subscriptions and fraud prevention | Name, email, billing address, payment method (Stripe holds the card number), transaction and dispute records | United States |
| Resend | Transactional and marketing email, and inbound replies | Recipient email addresses, message content, and delivery, bounce and complaint events | United States |
| Anthropic | AI analysis and fix writing | Page snippets and screenshots from scans; document images with the text around them; app screenshots; app source excerpts; page URLs, titles, descriptions and page summaries for SEO fixes; change requests typed in the review queue; chat messages on scan and checkout pages; replies from businesses we emailed | United States |
| Amazon Web Services (Bedrock) | An alternative AI provider for fix writing, used instead of the Anthropic API only if we switch our fix worker to it, after the notice described below | The same fix-writing inputs the Anthropic API receives | The AWS region we configure |
| Plausible Analytics | Cookieless visit counts for our own website, when enabled | Page URL, referrer, and browser, device and country derived from the request; no cookies and no stored IP address | European Union |
| Sentry | Error monitoring and performance tracing | Stack traces, URLs, user identifiers | United States |
| ZeroBounce | Checking that a published business email address can receive mail before we email it, when enabled | Business email addresses from our lead lists | United States |
| WebAIM (WAVE API) | An independent accessibility check of a page after we fix it, when enabled | The public URL of the fixed page | United States |
| Microsoft 365 | Email hosting for support@remediada.com and our other addresses | Messages you send us and our replies, with the names and addresses in them | United States |
| Google (Places API) | Finding businesses and their public websites for lead generation | Search terms such as business category and location; returns public business listings | United States |
| Yelp (Fusion API) | Finding businesses and their public websites for lead generation, when we have an account key for it | Search terms such as business category and location; returns public business listings with phone numbers | United States |
| Foursquare (Places API) | Finding businesses and their public websites for lead generation, when we have an account key for it | Search terms such as business category and location; returns public business listings, including any published email address and phone number | United States |
| Slack | Internal notifications to our team when a remediation job finishes, or when our automatic visual check holds a remediation before it is applied, if enabled | The customer's business name and website address, and the job's results; for a held remediation, the site address and the size of the visual change | United States |
Platforms you connect. GitHub, WordPress, Shopify, Webflow, Squarespace and Wix are not on this list. When you connect one, we read your site or repository and, where the platform allows it, write our fixes to it under your own account with that platform, and your agreement with that platform covers what it does with the data.
Public sources. For lead generation we also look up public map data from OpenStreetMap, through its Nominatim and Overpass services. We send it a place name and a business category, never personal data, so it is a source rather than a sub-processor.
Certificate anchoring. When it is enabled, we write a SHA-256 hash of each conformance certificate to the Base public blockchain, so anyone can check that the certificate has not changed. Only the hash is written, never the certificate itself, and a record on a public blockchain cannot be deleted.
Changes
Notice before we add or replace one
We update this page and email the account owner of every customer account at least 30 days before a new or replacement sub-processor starts processing personal data. If you have a Data Processing Agreement with us, you can object within that period, as the agreement describes.
Questions go to support@remediada.com.