Subprocessors
Last updated September 11, 2026 · POVV Kacper Gardocki — sole proprietorship (JDG), Poland · NIP 9151840843
POVV is the data controller. The providers below process data for the purposes listed. They act as processors when processing on our instructions, and may also act as controllers for their own account, legal or regulatory obligations. If we add a provider, we update this page and the Privacy Policy together.
| Processor | Purpose | What it receives | Location |
|---|---|---|---|
| Anthropic | Language-model inference (the technical audit agent) | Source-code excerpts and repository metadata submitted for analysis | United States |
| xAI | Language-model inference (the adversarial business agent) | Source-code excerpts and repository metadata submitted for analysis | United States |
| Supabase | Primary database, authentication, storage | Account identity, audit runs, sealed verdicts, encrypted GitHub tokens | European Union |
| GitHub | Source of the repositories you ask us to audit | Repository reads performed with the access you grant us | United States |
| Stripe | Payments, subscriptions, invoicing | Billing identity, payment method (held by Stripe, never by us), transaction history | United States / European Union |
| Striptu — FREELANCE Kamil Jabłoński | Stripe-to-inFakt invoice automation | Billing identity, contact and tax details, account and transaction references, line items, amounts, currency, tax and payment status | Registered in Poland; published terms allow transfers outside the EEA |
| inFakt Sp. z o.o. | Invoice creation, customer invoice emails, KSeF submission and accounting records | Customer billing identity, contact and tax details, invoice items and amounts, payment references and accounting records | Registered in Poland; published terms allow transfers outside the EEA |
| Vercel | Application hosting and serverless compute | All request traffic in transit, application logs | United States / European Union |
| Cloudflare | DNS, TLS termination, WAF and bot protection at the edge | Request metadata (IP address, user agent, path) in transit | Global edge network |
| Upstash | Redis — rate limiting, spend caps, ephemeral audit progress | IP-derived rate-limit counters, short-lived run progress messages | European Union |
| PostHog | Product analytics (currently not enabled in production) | Pseudonymous usage events, subject to your cookie choice | European Union |
Billing connection
The Striptu connection from Stripe to our existing inFakt account is configured for invoice creation, customer invoice emails and submission to KSeF. Its scope is billing and invoice records; it does not include repository snapshots, GitHub access tokens or verdict contents. See Striptu’s privacy policy and published data-processing agreement, and inFakt’s privacy policy and terms with data-processing provisions.
inFakt’s published data-processing terms permit data in documents entered into its application to be used to train its own AI solutions. Our source-code training statement below concerns repository audits, not financial documents held by accounting providers.
Your code and model training
Source code you submit is sent to Anthropic and xAI for inference, because that is what produces the audit. We do not sell it, publish it, or train any model on it. Both providers are engaged on their commercial API terms, under which content submitted through the API is not used to train their models — a contractual position we rely on, not something we can verify inside their infrastructure.
Separately, POVV uses its own outputs — the verdicts, findings and synthesis the engine generates — in anonymized or aggregated form to improve its services, including a specialist audit model trained on our own hardware. Private-repository verdicts carry hash anchors and never verbatim source, so private code cannot enter that corpus; public-repository verdicts may contain short verified quotes from code that was already public. The full statement is in the Privacy Policy.
Transfers outside the EEA
Several processors are established in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses and each provider’s own transfer framework commitments. the President of the Personal Data Protection Office (UODO), Warsaw, Poland is our supervisory authority.
Questions
Email [email protected]. Business customers who need a signed data processing agreement should ask — we will provide one.