About This List
This page lists the third-party service providers ShipReady engages as subprocessors to deliver the Service. It is published for transparency and forms part of our data-protection commitments: it is incorporated by reference into our Privacy Policy and our Data Processing Addendum.
Each subprocessor is engaged under contractual obligations consistent with applicable data-protection law, including, where required, the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. We share only the minimum data each provider needs for its function.
Current Subprocessors
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| VercelVercel Inc. | Application hosting, serverless functions, CDN, and traffic analytics | Account identifiers, request logs, IP addresses, technical telemetry | United States (global edge) | SCCs / EU-U.S. Data Privacy Framework |
| SupabaseSupabase Inc. | Authentication, primary database, and file storage | Account data, scan targets and results, integration tokens (encrypted), session data | United States / EU | SCCs / EU-U.S. Data Privacy Framework |
| Dodo PaymentsDodo Payments Inc. | Payment processing, subscription billing, and invoicing as merchant of record | Billing email, country, payment-method metadata, transaction history | United States / India | SCCs / contractual safeguards |
| GitHubGitHub, Inc. (Microsoft Corp.) | Repository scanning, only for repositories you explicitly connect | Repository metadata and contents you authorize, installation token (held encrypted) | United States / EU | SCCs / EU-U.S. Data Privacy Framework |
| SentryFunctional Software, Inc. | Application error monitoring and alerting | Error stacks, request metadata, user identifier where attached | United States / EU | SCCs / EU-U.S. Data Privacy Framework |
| Google AnalyticsGoogle LLC | Aggregate website traffic and product usage analytics | Event metadata, page paths, truncated IP address, device and browser data | United States / EU | SCCs / EU-U.S. Data Privacy Framework |
| Email delivery (SMTP)Our transactional email provider | Delivery of account, security, billing, and scan notification emails | Email address, message content, delivery metadata | United States / EU | SCCs / EU-U.S. Data Privacy Framework |
| Logo.devLogo.dev | Serving company logo images for scanned domains in the dashboard UI | Domain name of the scanned target only | United States | Public asset lookup; no personal data shared |
| Public vulnerability dataNVD (NIST) and equivalent public CVE sources | CVE lookup for dependency and configuration checks | Package names and version strings submitted for lookup | United States | Public-data lookup; no personal data shared |
GitHub is engaged only when you explicitly connect a repository, and only for the repositories you authorize. Disconnecting the integration revokes that access.
Notification of Changes
We may add or replace subprocessors as needed to deliver, secure, or improve the Service. We will give reasonable advance notice of any new subprocessor that processes personal data on behalf of customers, generally by updating this page. Customers under a Data Processing Addendum may subscribe to email notifications by writing to us with the subject “Subprocessor Updates.”
Objection
Customers under our DPA may object in writing, on reasonable data-protection grounds, to a proposed new subprocessor within thirty (30) days of notice. If the objection cannot be resolved through appropriate measures, you may terminate the affected portion of the Service without penalty. See Section 7 of the DPA.
Contact
To ask about a subprocessor, request change notifications, or raise an objection, contact us at:
hello@useshipready.dev