Sub-processors
The companies that handle data for us, what each one does and where its data lives.
| Name | What it does for us | Where its data lives |
|---|---|---|
| Supabase | Database and private file storage: accounts, products, uploaded SBOMs and incident records. | EU region, chosen when the project is created. |
| Resend | Sends every email we send. To our users: sign-in links, team invitations and the two emails about a change of email address; Article 14 deadline reminders, and reminders that a support period or a security.txt file is about to run out; vulnerability alerts, daily digests and weekly summaries, a note when a finding is assigned to you or a suppression is about to expire, and the test emails you ask for; notices about your plan and payments, a data export, a scheduled or cancelled deletion of your organisation and a deleted account; and notices from us about the service, about a change to the legal state your documents are stamped with, about our decision on a mapping report your organisation filed, and about a suspension or a hidden public page. Alerts and reminders also go to any extra address your organisation adds for them. Resend also carries the alerts our own systems send to us when something breaks, which can name the organisation affected. It sends nothing to the customers on an incident’s contact list: we never email them. | EU region, chosen when the sending domain is added. |
| Cloudflare Turnstile | Bot check on the free SBOM check’s “Check for known vulnerabilities” step, the “Report a page” form, and the sign-in page when you create an account, sign in with a password or ask for a sign-in link. | To be confirmed |
| Sentry | Receives error reports so we can fix faults. | EU data region, chosen when the project is created. |
| Plausible | Page statistics without cookies. | To be confirmed |
| Vercel | Hosts the website and app and runs the scheduled jobs. | The app and its scheduled jobs run in Frankfurt, Germany. |
| GitHub | Signs you in with your GitHub account, if you choose to, and passes us the name, email address and profile picture on it. Keeps a second copy of our weekly backup of the database and uploaded files for 35 days. The backup is encrypted before it reaches GitHub, so GitHub cannot read it. Beside it, not encrypted, are two lists: how many rows each table holds, and each stored file by internal id, size and checksum, with file names removed. | To be confirmed |
| Paddle | Takes payment for paid plans. | To be confirmed |
| Name | What it receives | Where its data lives |
|---|---|---|
| OSV (osv.dev, run by Google) | The package identifier of each component that has one, with its version where OSV can compare it, and the version of a Linux kernel in the list. | Not stated by the provider. |
| GitHub (advisory database) | The package type, name and version of each component whose package type GitHub indexes. | Not stated by the provider. |
| ENISA (EU Vulnerability Database, EUVD) | The vendor and product name of each component identified by a CPE or by name alone. | Not stated by the provider. |
These are not companies that handle data for us under a contract. They are public databases our server asks when you use the “Check for known vulnerabilities” step of the free SBOM check. They receive component names, versions and identifiers from your list, never the file, and they see our server, not your IP address.
Files you upload to an account are not sent to them. Uploads are matched against our own copy of those databases.
Rows marked “to be confirmed” are places where we have not yet written down a region. Questions: privacy@declarable.io.
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.