Sub-processors

In use

Processing Rebilder data today under the vendor’s data-processing terms.

Not yet contracted

Provisioned in our configuration and required by a feature that is being built, but no data-processing agreement is signed yet. It is listed here before it processes anything, not after.

Our own data-processing agreement with you, and the sub-processor notification period in it, is TODO_OWNER: Rebilder DPA — template and notification period to be settled with counsel. Until that exists, we commit here to posting a new sub-processor on this page before it starts processing, and to emailing account holders at least 30 days beforehand unless the change is required by law or is a response to a live security threat.

Vercel — United States — in use

Purpose: application hosting and CDN for rebilder.com and the Rebilder API. Data category: HTTP request metadata (IP address, user agent, path, timestamps) in standard platform logs, and cached page bodies. It does not hold database contents.

Supabase — United States — in use

Purpose: the Postgres database behind the Console and the scanner, plus authentication for Console sign-in. Data category: Console account and organisation records, API key hashes, gateway events, scan records, scanner leads with their consent records, and hashed IP rate-limit buckets. This is the same cluster MUMM uses, under a separate schema and a separate database role that has no access to MUMM data.

Resend — United States — not yet contracted

Purpose: sending the scan report you asked for, plus Console notifications. Data category: your email address, the message we send you, and delivery events (delivered, bounced, complained). Rebilder uses its own API key, its own sending domain, its own consent record and its own suppression list, entirely separate from MUMM’s — a shared sending identity would put two unrelated audiences in one reputation and one bounce list.

Cloudflare (Turnstile) — United States — not yet contracted

Purpose: the challenge that stands between the free scanner and being used as an attack tool. It is the fourth layer of the rate-limit ladder — it is never shown for a first scan, only after repeated scans from one address or under heavy global load. Data category: your IP address and browser signals, collected by Cloudflare directly from your browser, plus a challenge token we verify server-side. We do not receive the signals; we receive a pass or a fail.

• No model provider. No LLM is called on any request-serving path, and none is called anywhere in the scoring path — the score is a pure function of a content-addressed evidence bundle, with no model, no randomness and no clock in it.
• No product-analytics vendor and no advertising pixel on rebilder.com.
• No third-party error-tracking service holding Rebilder data today.
• No data broker, enrichment vendor, or list provider, ever. We do not buy contact data and we do not sell yours.

Payment processing is not listed because paid plans are not yet billable on rebilder.com; the processor is TODO_OWNER: payment processor for rebilder.com — to be selected, contracted, and added to this list before the first paid plan. It goes on this page before it takes a payment.

New vendor, new category of data, or a change in country of processing: posted here first, and emailed to account holders at least 30 days ahead unless the law or a live security threat requires it sooner. If you object to a new sub-processor, tell us at privacy@rebilder.com before it takes effect and we will work it out or let you leave with a refund of the unused period.