Patcharo — Sub-processors and providers
Version of 24 Oct 2026

The providers that process personal data to run Patcharo, their role, where processing takes place and the safeguards that frame transfers.

1. Sub-processors for Customer Data

The following providers process Customer Data on the Publisher's behalf, under the data processing agreement (https://patcharo.com/legal/dpa). They also process the data the Publisher is responsible for (accounts, security, service e-mails), described in the privacy policy (https://patcharo.com/legal/privacy).

- Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States
  Role: Hosting and execution of the application, delivery of pages, protection against attacks and bots
  Data concerned: All data exchanged with the site and the application while in transit and processed
  Place of processing: Cloudflare's global network: a request may be processed in a data centre outside the European Union
  Safeguards: Cloudflare's data processing addendum (version 6.4), the European Commission's standard contractual clauses; Cloudflare, Inc. participates in the EU–US Data Privacy Framework
- Provider: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, on Amazon Web Services infrastructure
  Role: Database and authentication
  Data concerned: Accounts, Workspaces and Customer Data
  Place of processing: Database and authentication in Paris (AWS region eu-west-3); access possible from Singapore or the United States for the provider's support and operations
  Safeguards: Supabase's data processing addendum (version 1), the European Commission's standard contractual clauses
- Provider: Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States
  Role: E-mail delivery: account confirmation, password reset, alerts
  Data concerned: Recipient address and e-mail content, including the Workspace and device names and the watch labels or watched IP addresses that appear in an alert
  Place of processing: United States; content and delivery logs kept for 30 days by the provider
  Safeguards: Resend's data processing addendum, standard contractual clauses; Plus Five Five, Inc. participates in the EU–US Data Privacy Framework
- Provider: Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands
  Role: Mailboxes of the @patcharo.com addresses (support, contact, security)
  Data concerned: Content of the e-mails you send us and of our replies
  Place of processing: Zoho's data centres in the European Union (Netherlands, Ireland)
  Safeguards: Provider established in the European Union; occasional access by its support team from India is covered by standard contractual clauses

2. Other providers

- Provider: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland
  Role: Online payment and invoices, once online payment opens
  Data concerned: Customer's identity and billing address, VAT number, owner's e-mail, payment method, payments and invoices; no Customer Data
  Place of processing: Ireland, with transfers to Stripe, LLC in the United States
  Safeguards: Stripe's data processing agreement and its transfer clauses; Stripe, LLC participates in the EU–US Data Privacy Framework. Stripe also acts as a controller for its own obligations (fraud and anti-money-laundering)
- Provider: Mistral AI, 15 rue des Halles, 75001 Paris, France
  Role: Machine translation, between French and English, of public texts from the vulnerability sources
  Data concerned: Public texts only (vulnerability descriptions, published advisories): no Customer Data and no account data is sent to it
  Place of processing: Regular translations processed in European Union or EFTA data centres (Mistral AI's European endpoint); occasional batch catch-ups go through its global endpoint; texts kept for 30 days by Mistral AI for abuse detection
  Safeguards: Not applicable: no personal data of Users or Customers

3. Changes of providers

The Publisher informs Customers of any addition or replacement of a sub-processor of Customer Data at least 30 days in advance, by e-mail to the owner of each Workspace and by updating this page. The Customer may object on reasonable data protection grounds, as set out in the data processing agreement. Each version of this page is dated and remains available.

A copy of the safeguards framing a transfer can be obtained on request at contact@patcharo.com.