Trust
Subprocessors
The third-party services dvt relies on to operate the product, plus the separate vendors behind its outbound outreach email, what each one processes, and where. Because queries run in your warehouse, none of these services receive your warehouse's data rows or values.
| Service | Purpose | Data processed | Region |
|---|---|---|---|
| WorkOS | Authentication & identity (sign-in, organizations, directory) | Names, email addresses, organization & membership metadata | United States |
| Neon | Metadata database (dashboard specs, accounts, roles, audit logs, encrypted credentials) | Account metadata and dashboard specs; warehouse credentials as ciphertext; opt-in warehouse catalog structure (names/types/comments only, never data rows or values). | United States |
| Fly.io | Application & query-engine hosting (compute) | Data in transit during a request; nothing persisted to disk by dvt | United States |
| Cloudflare | CDN, DNS, website hosting, and encrypted object storage (R2) for dashboard exports and trial CSV uploads | Website traffic; PNG/PDF export artifacts (encrypted, organization-scoped, retained indefinitely — no deletion schedule, and closing an organization does not delete them; deleted on request — email [email protected]); trial CSV uploads (encrypted Parquet, organization-scoped, deleted by an automated job after the trial ends) | Global edge (exports & uploads: western North America — Cloudflare location hint, not a residency guarantee) |
| Resend | Transactional email (sign-in and product notifications) | Email addresses and message content | United States |
| Sentry | Error tracking (application errors across our services) | Diagnostic/error events — may include user IDs, request context, and stack traces | United States |
| Axiom | Application logs | Application logs and request metadata — may include user/organization IDs | United States |
Outbound outreach email (not product or customer data)
These vendors process only business-contact details for dvt's own outreach (dvt as controller), never customer or product data, and they are not subprocessors under the Data Processing Addendum. See /privacy#outbound-outreach.
| Service | Purpose | Data processed | Region |
|---|---|---|---|
| Google Workspace | Mailbox for dvt's outbound outreach email agent (dvtagent.com) | Outreach recipients' work email address, name, and the messages and replies | United States (primary; no data-residency commitment on this plan) |
| Anthropic | Model used by the outbound outreach email agent to research and draft messages and to sort replies to them | Outreach recipients' name, title, company, and public company information, whether their details came from public sources or our founders' communities, and the subject and text of replies to outreach messages, from whoever sends them — never product or warehouse data | United States |
| Cloudflare | Workers and D1 database that run the outbound outreach email agent | Outreach recipients' work email, name, title, company; contact source (public or founder community); send log; hashed suppression list | Global edge |
| Hunter | Contact discovery and email verification for the outbound outreach email agent | Receives: company domain, prospect name, work email address. Returns: names, titles, and work email addresses from its own database | Belgium (EU) |
This list is kept current as our infrastructure evolves. For a data processing agreement (DPA) or advance notice of subprocessor changes, email[email protected]. See also oursecurity overview.