Subprocessors

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

GLAV uses the third-party service providers below to deliver the Service. Where they process personal data on behalf of our customers, they act as our subprocessors under our Data Processing Addendum. We will give at least [SUBPROCESSOR NOTICE DAYS] days’ notice before adding or replacing a subprocessor. To be notified of changes, [HOW TO SUBSCRIBE, e.g. email PRIVACY CONTACT EMAIL].

Subprocessor: Amazon Web Services
Legal entity and country: Amazon Web Services EMEA SARL (Luxembourg) as contracting party for EEA accounts; Amazon Web Services, Inc. (United States) is the parent
Purpose: Cloud infrastructure, including storage of test evidence (Amazon S3) [AND WORKER COMPUTE — CONFIRM]
Processing region: [REGION, e.g. EU (Frankfurt)]
Transfer safeguard: EU region selected by GLAV; SCCs in the AWS DPA for any transfers

Subprocessor: Supabase
Legal entity and country: Supabase Pte. Ltd. (Singapore), with support and operations by Supabase, Inc. (United States)
Purpose: Database (Postgres) and authentication
Processing region: [REGION, e.g. EU (Frankfurt)]
Transfer safeguard: SCCs in the Supabase DPA for transfers to Singapore and the US

Subprocessor: Vercel
Legal entity and country: Vercel Inc. (United States)
Purpose: Web application hosting and delivery
Processing region: [REGION, e.g. EU (Frankfurt)] for functions; global edge network
Transfer safeguard: EU-U.S. Data Privacy Framework and/or SCCs in the Vercel DPA

Subprocessor: Resend
Legal entity and country: Plus Five Five, Inc., trading as Resend (United States)
Purpose: Transactional email (account, security and notification emails)
Processing region: [REGION, e.g. EU (Ireland) sending region]; account data, logs and metadata stored in the United States
Transfer safeguard: EU-U.S. Data Privacy Framework and SCCs in the Resend DPA

Subprocessor: [AI MODEL PROVIDER]
Legal entity and country: [ENTITY AND COUNTRY]
Purpose: Large language model inference used by the pentest engines (e.g. Strix) to plan tests and analyse results; may receive target responses and evidence
Processing region: [REGION]
Transfer safeguard: [TRANSFER SAFEGUARD]

Payment processing

Provider: Polar
Legal entity and country: Polar Software, Inc. (Delaware, United States)
Purpose: Merchant of record: checkout, subscription billing, invoicing, sales tax/VAT, refunds
Role: Polar sells the subscription to you and acts as an independent controller for payment and tax data under its own terms and privacy policy. It does not receive customer test data.

Notes

• AI model provider. The pentest engines call external large language model APIs. The provider(s), their location and the data sent to them must be confirmed before publication. This row is a placeholder.

• Regions. Regions marked [REGION] depend on GLAV’s account configuration and must be confirmed.

• Each provider may in turn use its own subprocessors, which are listed on that provider’s website.