Sub-processors

Hostinger International Ltd. (servers in the EU) — hosts the application server, the scan worker and the PostgreSQL database. Receives everything stored by the product, including scan credentials, which are encrypted before they are stored.

Cloudflare, Inc. (US; standard contractual clauses) — DNS and TLS for reachcanon.com, where it sees request metadata but not database contents; and, once offsite backups are switched on, R2 object storage in an EU-jurisdiction bucket for database backups, which are encrypted with AES-256-GCM before they leave the server, with a key Cloudflare never receives.

Resend, Inc. (US; standard contractual clauses) — sends transactional email (sign-up, password reset, invitations, scan and regression alerts); receives the recipient address and the message.

Stripe Payments Europe, Ltd. and Stripe, Inc. (EU and US; standard contractual clauses) — once paid plans are on sale, processes payments, tax calculation and invoices; receives the workspace identifier, the billing contact and address, any VAT number, and the payment details entered directly in its hosted checkout or portal. Reachcanon stores subscription identifiers and status, never full card details.

There is no AI provider: no feature sends your content to a language model. We give at least 30 days' notice by email before adding or replacing a sub-processor, and this list is updated before a new one is used; you may object as the data processing agreement describes.