The third parties that process data on our behalf and yours.
The principal vendors ScanPosture relies on, their purpose, the categories of data they touch, and the region in which they process it.
Grouped by where data is processed
The primary database is configured in London. Other providers can process information internationally. Account-specific processing locations, contracting parties and transfer safeguards need to be checked for the services you use.
Supabase
United Kingdom (London)
Primary database, authentication backend and storage
All customer-tenant data, accounts, scan results, findings, audit logs, billing references
Postgres + Row-Level Security; AES-256 at rest at the storage layer.
Vercel
Distributed hosting and support; regions depend on account configuration
Application hosting, serverless compute, scheduled jobs
Web requests, submitted form data, request metadata, application logs and build artefacts.
Resend
Provider processing and email delivery may involve countries outside the UK
Transactional email delivery (account, scan summaries, alerts)
Recipient email address, message subject, message body, delivery status
Stripe
International processing under the applicable Stripe arrangement
Subscription billing and payment processing
Billing-account email, invoice history, card token (handled by Stripe, never stored by ScanPosture). Per-month seat counts pushed from completed scans.
Cloudflare
Global edge network
DNS, edge proxy, Turnstile bot challenge on signup forms, and cookieless web analytics on the public marketing site
Request metadata only. Turnstile processes challenge and technical request information. Web analytics records page views, referrer, and country-level location, with no cookies and no individual identifiers.
Microsoft (Graph + Exchange Online + SharePoint Online)
Customer’s own Microsoft tenant region
Read-only assessment of customer Microsoft 365 / Entra ID configuration
Configuration metadata only, read-only Graph, Exchange and SharePoint admin scopes. No mailbox or document content. No write actions.
Microsoft is the customer’s own primary processor; ScanPosture acts on the customer’s behalf via admin consent.
GitHub
United States
Source-code hosting, CI/CD pipelines (deploy workflows)
Source code only. Build artefacts and workflow logs must be managed to avoid including customer records.
Change notification
We notify customers of changes to this list in advance, as required by the ScanPosture Data Processing Agreement. Customers may object to a proposed sub-processor change in line with the terms set out in the DPA. Questions about this list? Ask us.