Subprocessors
Last updated August 22, 2026 · POVV Kacper Gardocki — sole proprietorship (JDG), Poland · NIP 9151840843
POVV is the data controller. The companies below are processors acting on our instructions to deliver the service. This page names all of them; if we add one, we update this page and the Privacy Policy together.
| Processor | Purpose | What it receives | Location |
|---|---|---|---|
| Anthropic | Language-model inference (the technical audit agent) | Source-code excerpts and repository metadata submitted for analysis | United States |
| xAI | Language-model inference (the adversarial business agent) | Source-code excerpts and repository metadata submitted for analysis | United States |
| Supabase | Primary database, authentication, storage | Account identity, audit runs, sealed verdicts, encrypted GitHub tokens | European Union |
| GitHub | Source of the repositories you ask us to audit | Repository reads performed with the access you grant us | United States |
| Stripe | Payments, subscriptions, invoicing | Billing identity, payment method (held by Stripe, never by us), transaction history | United States / European Union |
| Vercel | Application hosting and serverless compute | All request traffic in transit, application logs | United States / European Union |
| Cloudflare | DNS, TLS termination, WAF and bot protection at the edge | Request metadata (IP address, user agent, path) in transit | Global edge network |
| Upstash | Redis — rate limiting, spend caps, ephemeral audit progress | IP-derived rate-limit counters, short-lived run progress messages | European Union |
| PostHog | Product analytics (currently not enabled in production) | Pseudonymous usage events, subject to your cookie choice | European Union |
Your code and model training
Source code you submit is sent to Anthropic and xAI for inference, because that is what produces the audit. We do not sell it, publish it, or train any model on it. Both providers are engaged on their commercial API terms, under which content submitted through the API is not used to train their models — a contractual position we rely on, not something we can verify inside their infrastructure.
Separately, POVV uses its own outputs — the verdicts, findings and synthesis the engine generates — in anonymized or aggregated form to improve its services, including a specialist audit model trained on our own hardware. Private-repository verdicts carry hash anchors and never verbatim source, so private code cannot enter that corpus; public-repository verdicts may contain short verified quotes from code that was already public. The full statement is in the Privacy Policy.
Transfers outside the EEA
Several processors are established in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses and each provider’s own transfer framework commitments. the President of the Personal Data Protection Office (UODO), Warsaw, Poland is our supervisory authority.
Questions
Email [email protected]. Business customers who need a signed data processing agreement should ask — we will provide one.