Providers that process information for us#
Each provider processes personal information only to provide its service to us, under its own contractual and security terms.
Provider
What it receives and why
Where
Railway
Hosts our application, database and logs, so it holds everything in them
United States
Cloudflare
Network delivery and protection for our website (every visitor request passes through it); storage of encrypted database backups in Cloudflare R2
United States and its global network
GitHub
Storage of a second set of encrypted database backups
United States
Stripe
Payment processing. Receives the buyer’s name, email address and card details (the card goes straight to Stripe)
United States
Resend
Delivers the email our systems send. Receives the recipient’s name and address and the message; returns delivery and open events
United States
Google Workspace
Our mailboxes, from which staff and representatives send and receive email
United States
Anthropic
AI model (Claude): drafting summaries; reviewing paid assessment findings and public web pages before a person approves the release; the AI Impersonation Check; assistant chats; sorting email we receive and drafting replies a person reads before sending; finding a contact at a firm; checking Perimeter web results. Anthropic does not train its models on what we send
United States
Google (Gemini)
The AI Impersonation Check, which receives a firm’s name, domain and city; checking Perimeter web results; finding a firm’s contact name when staff choose it; pulling facts from public news articles
United States
Instantly
Sending some outreach email campaigns when staff choose to. Holds the business contact details sent to it
United States
Dropbox Sign
Electronic signature of engagement letters. Receives the signer’s name and email address
United States
Slack
Internal notifications to our team, which can name sales representatives and applicants
United States
Microsoft and Google (account connections)
Only for a customer who connected a Microsoft 365 or Google Workspace account to our former mailbox review: user, sign-in, mail-rule and device settings in that account. The review is no longer offered; raw data from a review is deleted 90 days after it completed
United States
Sentry
Error monitoring, configured not to send personal information by default
United States
Sources we query to run a check#
These services hold the information being checked. They receive the item being checked, not anyone’s account details.
Source
What it receives
Where
Breach-data provider
An email address or phone number being checked, or a firm’s domain
Australia
Serper
A firm’s name or domain; for Perimeter, the names, other names and public handles of household members who consented
United States
Hunter
A firm’s domain, or a person’s name and work domain, to find and verify a published work address
France
Google Places
A business name and city
United States
Perplexity (where enabled)
A firm’s name, domain and city, for the AI Impersonation Check
United States
OpenAI (where enabled)
A firm’s name, domain and city, for the AI Impersonation Check
United States
xAI (Grok) (where enabled)
A firm’s name, domain and city, for the AI Impersonation Check
United States
Microsoft (Azure AI with Bing search) (where enabled)
A firm’s name, domain and city, for the AI Impersonation Check
United States
Reddit search
Perimeter only: the names of household members who consented
United States
Domain, network and reputation records
A domain, an IP address or a firm name only: Shodan, VirusTotal, SecurityTrails, AbuseIPDB, PhishTank, URLhaus, crt.sh, CertSpotter, HackerTarget, ipapi.co, Mozilla Observatory, the Internet Archive, domain registries (RDAP and WHOIS, including CIRA) and the federal insolvency records search
Various
Changes to this list#
We update this page before we add a provider that processes customer personal information.
- 8 October 2026: OpenAI, xAI (Grok) and Microsoft (Azure AI with Bing search) are added: where enabled, each receives a firm’s name, domain and city for the AI Impersonation Check. The entry of 6 October below said the Google (Gemini) uses that rely on Google Search results were off. They are on, and the Google (Gemini) row above lists them.
- 6 October 2026: Google (Gemini) is listed only for what is switched on. Its uses that rely on Google Search results are off under Google’s terms for those results; Anthropic (Claude) does that work.
- 30 September 2026: list published. BreachDirectory (through RapidAPI) and Apollo are no longer used.