Subprocessors
Version 1.1 — last reviewed 11 October 2026.
These are the third parties that process personal data on our behalf when we provide Vigil. This page is referenced by our Privacy Policy and forms Annex III of our Data Processing Agreement.
Notice of changes. We give 30 days' notice before adding or replacing a subprocessor, by email to customers subscribed for such notices and by updating this page. A customer may object on reasonable data-protection grounds within that period, as set out in Section 6 of the DPA.
Current subprocessors
| Subprocessor | What it does | Data it may process | Location |
|---|---|---|---|
| Railway Railway Corp. (USA) | Application hosting, background jobs, the managed PostgreSQL database, and object storage for page snapshots | All stored account and customer data; runtime data, logs, IP addresses, snapshot files | EU — Netherlands |
| Polar Polar Software, Inc. (USA) | Reseller and merchant of record — checkout, payment, invoicing, tax | Name, email, billing address, tax status, payment data (card data never reaches us) | USA |
| Resend Resend, Inc. (USA) | Transactional and digest email delivery | Recipient email address and message content | USA |
| Anthropic Anthropic, PBC (USA) | AI-assisted extraction on the Scale, Agency and Enterprise plans, where heuristic extraction fails | The visible text of a public retail page. No account data, no store credentials, no contact data. | USA |
Transfers to subprocessors outside the EEA are made under the European Commission's Standard Contractual Clauses (2021/914). Polar acts as an independent controller for payment data. Anthropic's commercial API terms provide that inputs are not used to train models.
Not subprocessors
These receive data but are not our subprocessors, because you direct the flow:
- Your Shopify or custom store — we connect using credentials you create and can revoke.
- Your Slack workspace or webhook endpoint — if you configure alert delivery there, we send at your instruction.
- Recipients of your client share links — you choose who gets a link.
Documentation
For each subprocessor we hold a data processing agreement incorporating the Article 28 GDPR obligations and, where the provider is outside the EEA, the Standard Contractual Clauses. Copies are available to customers on request at info@nitech.si, subject to confidentiality.
Change log
- 21 August 2026 — initial published list.
- 20 August 2026 — Stripe removed as payment processor; replaced by Polar as reseller and merchant of record.
- 24 August 2026 — the database moved from Supabase to Railway Postgres, in the same EU region as the application. No new subprocessor: Railway was already listed for hosting.
- 26 August 2026 — Supabase removed. The project was decommissioned and holds no copy of customer data.
See also our Data Processing Agreement and Privacy Policy.