Who helps us run ValiqAI.
We use a small number of outside companies, called subprocessors. Each one only gets the data it needs for its job, and each is bound by data processing terms. This list is part of our Data Processing Agreement.
Last updated September 29, 2026
Subprocessors at a glance
- Always used
- 7 companies
- Only if you choose them
- 4 companies
- AI providers
- Anthropic and OpenAI
- AI training on your data
- Never
- Hosting
- Railway, United States
- Scan files
- Cloudflare, private links
- New companies
- Listed here before we use them
Always used
These are part of how ValiqAI runs for everyone.
- Anthropic, PBC(privacy policy, opens in a new tab)
United States
Doesn’t train its models on data sent through its API.
Does: AI that plans each scan, analyzes pages, and writes the report
Receives: The site you test: its address, page content, and screenshots, including pages behind a login when ValiqAI signs in. Never your ValiqAI password, payment details, or API keys.
- OpenAI, L.L.C.(privacy policy, opens in a new tab)
United States
Doesn’t train its models on data sent through its API.
Does: AI that reads pages and screenshots during a scan
Receives: The site you test: its address, page content, and screenshots, including pages behind a login when ValiqAI signs in. Never your ValiqAI password, payment details, or API keys.
- Railway Corp.(privacy policy, opens in a new tab)
United States
Does: Hosts the app, the database, and the scan queue
Receives: All account and scan data stored by ValiqAI
- Cloudflare, Inc.(privacy policy, opens in a new tab)
United States or European Union, depending on storage settings
Files are private and open only through links that expire after an hour.
Does: Stores scan files
Receives: Screenshots, videos, recordings, network traces, and report files
- Stripe, Inc.(privacy policy, opens in a new tab)
United States
Does: Payments and billing
Receives: Billing contact, payment method, and transaction records
Does: Sends emails, such as account emails and waitlist and contact form messages
Receives: Email address and the content of the email
- MailSlurp (Pettman OÜ)(privacy policy, opens in a new tab)
Estonia (European Union)
Only used when a scan signs up with a temporary inbox.
Does: Temporary email inboxes, so a scan can sign up and receive codes
Receives: Emails the test inbox receives during a scan
Only if you choose them
These only receive data if you sign in with them or connect them to your account.
- Google LLC(privacy policy, opens in a new tab)
United States
Does: Sign in with Google
Receives: Your name, email address, and profile photo
- GitHub, Inc.(privacy policy, opens in a new tab)
United States
Does: Sign in with GitHub
Receives: Your name, email address, username, and profile photo
Does: Sends scan results to Slack, and runs scans from Slack
Receives: Scan summaries and findings, and the workspace and channel you connect
- Atlassian (Jira)(privacy policy, opens in a new tab)
Where your Jira site is hosted
Does: Creates Jira issues from findings
Receives: The findings you send to Jira, and the Jira site you connect
Good to know
Where your data goes, and how we handle changes.
Data sent abroad
Most of these companies are in the United States, so your data may be processed there. For personal data from the EU, UK, or Switzerland, we rely on safeguards such as Standard Contractual Clauses.
Before we add a company
We update this page before we start using a new company that handles customer personal data, and we change the date at the top.
Hear about changes first
Email abhi@valiqai.com and we’ll tell you before a change happens.
Each company’s own terms
Company names above link to each company’s privacy page, where their own data terms are.