Skip to main content
Draft: under legal review, not yet in force
This page is published for review. Its terms are not in force and are not offered until the review is complete and the draft marker is removed. Questions: legal@vulkro.com.

Sub-processors

Last updated: October 19, 2026

Vulkro is a product of Reveriext. These are the companies that process customer data on our behalf to run Vulkro, what each one does and what it receives. The data processing agreement says how we choose them and how we tell you before we add one.

The command line tools, the local console and the VS Code extension run on your own machines. A scan there sends your code and findings to none of the companies below.

Who processes customer data​

Cloudflare, Inc.​

  • What it does: hosts everything we run: vulkro.com, the customer portal, licence issuance, and every Vulkro Cloud workspace with its application, database, stored results, scan containers and encryption keys.
  • Data it receives: all the data the hosted services hold: account and member details, licences, workspace content, scan results, and the copy of a repository during its scan.
  • Location: not pinned to a jurisdiction; see where it is stored.

Clerk, Inc.​

  • What it does: sign-in for the portal and Vulkro Cloud, workspace organisations and members, and subscriptions (Clerk Billing).
  • Data it receives: names, email addresses, sign-in sessions with IP address and browser, organisation names and subscription status.
  • Location: United States.

Stripe, Inc.​

  • What it does: card payments, through Clerk Billing.
  • Data it receives: card and billing details and the email address. Card numbers are typed into Stripe's own fields and never reach our servers.
  • Location: Stripe's regions.

Resend​

  • What it does: the email Vulkro sends: account and licence email, answers to the contact and set-up forms, and workspace notifications set to be sent by Vulkro.
  • Data it receives: recipient names and email addresses, the content of the email, and licence files sent as attachments.
  • Location: Resend's regions.

Google (OSV, api.osv.dev)​

  • What it does: live vulnerability lookups in Vulkro Cloud, on by default; a workspace admin can turn them off.
  • Data it receives: the ecosystem, name and version of your repositories' dependencies, including private package names. Never code, file paths or repository names.
  • Location: Google's servers; OSV does not name a fixed region.

Services our web pages load​

These do not receive workspace data, but a visitor's browser contacts them when a page loads:

  • Google Fonts, on every page of the documentation site at docs.vulkro.com and on the Vulkro Cloud landing page at cloud.vulkro.com: the visitor's IP address and browser, when the page loads its fonts. vulkro.com itself loads no web font.
  • YouTube (youtube-nocookie.com), in blog and wiki posts with a video: the visitor's IP address and browser, when a page with a video loads.

Not our sub-processors​

Services you choose to connect are your own tools, under their own terms: Salesforce, your git host (GitHub, GitLab, Bitbucket or Azure DevOps), your own mail server, Slack, Microsoft Teams, Jira, PagerDuty, Google Chat, Discord, the webhooks you add, your identity provider and your AI assistant. Vulkro Cloud sends them only what you configure, as described on Vulkro Cloud data processing.

No AI model receives your workspace data, and we use no advertising, analytics or error-tracking company: vulkro.com counts page views on its own servers.

Changes to this list​

Before we add or replace a sub-processor that handles your workspace data, we update this page, as the data processing agreement describes. Questions: contact@vulkro.com.