Subprocessors
Running the Services means some of your data passes through companies that are not us. This is all of them, what each one does, and exactly what reaches it.
Note: we never download or store media from a finding, so no vendor here receives any — see Section 4.3 of the Terms. And we do not sell, rent or license your data to anyone. Every company here processes it to provide the Services, apart from Google, which sees traffic on our public marketing pages only — never your dashboard, a scan result or a claim link.
Laravel Cloud
cloud.laravel.com- What they do
- Application hosting and the primary database.
- What reaches them
- Everything the Services store: your account, the names you enroll, findings, and the record of what we filed.
DataForSEO
dataforseo.com- What they do
- Search engine results, which is how scanning finds anything at all.
- What reaches them
- The search queries we run on your behalf, which contain the names and handles you enroll. No results are stored with them.
Browserbase
browserbase.com- What they do
- Browser infrastructure for retrieving pages that refuse a plain request.
- What reaches them
- The URLs of pages we retrieve, and the pages that come back. Media is never downloaded — see Section 4.3 of the Terms.
Cloudflare
cloudflare.com- What they do
- Object storage for evidence captures and dashboard avatars, and the network layer in front of the Services, which tells human traffic from bots.
- What reaches them
- Evidence records — status, headers, HTML, final URL and hashes — and the avatar imported from an Approved Source under Section 4.4. As the network layer it also sees the IP address and request metadata of traffic reaching us, and sets the `__cf_bm` cookie described in the Privacy Policy.
Stripe
stripe.com- What they do
- Payment processing and subscription billing.
- What reaches them
- Your name, email address and payment details. Card details go to Stripe directly and are never stored by us.
Resend
resend.com- What they do
- Transactional email — scan results, notices, and account mail.
- What reaches them
- Your email address and the contents of the messages we send you.
Google
policies.google.com/privacy- What they do
- Analytics and advertising on our public marketing pages, through Google Tag Manager, Google Analytics and Google advertising products.
- What reaches them
- Page views and analytics and advertising cookies, on the homepage, pricing, the blog and our legal pages only. The tag is not loaded on your dashboard, a scan result or a claim link, so nothing about your names, findings or notices reaches it.
IPinfo
ipinfo.io- What they do
- IP address intelligence, used to record where an authorization was given.
- What reaches them
- IP addresses captured when you register, authorize us to act, or claim a scan.
If we add a subprocessor, it appears here. Questions about any of them go to legal@unleakedhq.com.