Subprocessor list
Generated 23 October 2026 from our subprocessor register.
The register is also published on our security page: https://barrierops.com/security#subprocessors.
| Provider | What it does for us | What it holds | Region | Region verified | Security attestation | State today |
|---|---|---|---|---|---|---|
| Vultr | Compute for the API and the scan worker | Data in transit and in memory, transient page content, and the services’ own logs on disk | New Jersey, United States | 16 Sep 2026 | Not yet obtained | Instances exist, stopped |
| Vultr Managed PostgreSQL | The database of record and its automated backups | All customer data except binary artifacts, including the evidence ledger | New Jersey, United States | 16 Sep 2026 | Not yet obtained | Running |
| Cloudflare R2 — evidence | Object storage for evidence artifacts | Screenshots, DOM captures, engine output, documents, reports, exports | Jurisdiction us | 1 Oct 2026 | Not yet obtained | Bucket barrierops-evidence created |
| Cloudflare R2 — backups | The off-Vultr logical backup | An encrypted logical copy of the database | Jurisdiction us | 3 Oct 2026 | Not yet obtained | Bucket barrierops-backups created; empty until the first nightly backup runs |
| Cloudflare Workers, DNS | Serve the static app and marketing site, and forward the marketing site’s form submissions to the API | Nothing at rest | Global edge; nothing at rest | 21 Oct 2026 | Not yet obtained | In use |
| WorkOS | Authentication (AuthKit) | Users, memberships and sealed sessions: names, work email addresses, sign-in events | Not yet established | Not verified | Not yet obtained | Test environment only |
| Sentry | Error reports from the API, the worker and the app | Error messages, stack traces, scan and organisation ids | United States | 1 Oct 2026 | Not yet obtained | Organisation and projects created; nothing sent until deployed |
| Axiom | Log, trace and metric storage | Service log lines and spans: URLs, ids, timings | United States (US East) | 1 Oct 2026 | Not yet obtained | Datasets created; nothing is sent until the services are deployed |
| Better Stack | Uptime monitoring and the status page | Probe URLs, response bodies of /healthz and the status page text. No customer data | Not yet established | Not verified | Not yet obtained | One uptime monitor, paused until the API is live |
| Resend | Transactional email | Recipient addresses and message bodies, kept by Resend for 30 days; once the public barrier-report form is live, the names and addresses of members of the public who report a barrier | United States; sending region US East (Virginia) | 20 Oct 2026 | Not yet obtained | In use: the worker sends the product’s transactional email from send.barrierops.com |
| GitHub | Source code, CI logs and container images (GHCR) | Source code, CI logs and container images. No customer data | Not applicable | 2 Oct 2026 | Not yet obtained | Explicitly out of scope, on the record |
This register is reviewed whenever a provider is added or changed, and at least once a year. You are told before a new provider reaches customer data, not after.