Subprocessors
The vendors that process account data so PIT can run. We do not sell that data. Our security posture is described at /security.
Effective 25 August 2026. Operator: AQX LLC. Related: privacy.
| Vendor | Purpose | Where |
|---|---|---|
| Google LLC (Google Cloud) | Hosting, objects, Cloud SQL, Cloud Run | us-central1 |
| Stripe, Inc. | Checkout, invoices, customer portal | United States |
| GitHub, Inc. | OAuth sign-in | United States |
| Google LLC | OAuth sign-in | United States |
| Resend, Inc. | Magic-link email | United States |
GitHub and Google see the identity you use to log in. They do not receive the corpus. Resend sends the magic-link mail when an email vendor is configured; otherwise the URL is logged and not sent. Local and laptop runs do not need these vendors.
The certified corpus is public-record metadata we ingest, not data about your customers. First-party events on POST /t stay on our side. We do not run GA4.
These five vendors are the whole list as of the date above. Commercial DPA on request: operations@aqx.llc.