ProbityProbity Subprocessors
Last updated: October 24, 2026
This is the current list of subprocessors Probity uses to provide the product, referenced from the Privacy Policy, section 5. We will update this list before adding or replacing a subprocessor that touches customer data, and will notify active account holders of a material change by email.
| Vendor | Purpose | Data it processes | Region | Terms |
|---|---|---|---|---|
| Supabase | Database (Postgres) and object storage for documents and application data | Account data, uploaded documents, journal content, pipeline and deal data. Supabase also handles sign-in (authentication) and sends the sign-in link and password-reset emails, so it receives your email address and those messages | United States | supabase.com/legal |
| Vercel | Application hosting and serverless compute; privacy-friendly, cookieless web analytics on the public marketing pages | Application traffic; transiently processes the same data as Supabase while a request is in flight. Web Analytics separately collects aggregate page views, referrers, country, and device type for the public marketing pages only, without cookies or any account-linked data; it is not enabled on pages behind sign-in | United States | vercel.com/legal |
| Anthropic | AI analysis (see Privacy Policy, section 4, for the complete list of features) | Document text and file content submitted for the specific analysis requested | United States (per Anthropic's published API infrastructure) | anthropic.com/legal/commercial-terms, anthropic.com/legal/privacy |
| Cloudflare | DNS and email routing (Sourcing Agent's forwarding address); bot protection (Turnstile) on our sign-in and sign-up pages | Email headers and content forwarded by a Deal Desk subscriber to their private forwarding address; on sign-in and sign-up, a verification signal that a human, not an automated script, is submitting the form | United States / global network | cloudflare.com/trust-hub |
| Sign-in (OAuth authentication) | Name, email address, profile photo (authentication scopes only; no mailbox or Drive access) | United States / global | policies.google.com/privacy | |
| Microsoft | Sign-in (OAuth authentication) | Name, email address, profile photo (authentication scopes only; no mailbox or OneDrive access) | United States / global | privacy.microsoft.com |
| Stripe | Payment processing for Deal Check and Deal Desk subscriptions and Cash Proof purchases | Card and billing details; Probity receives payment status and partial card identifiers only, not full card numbers | United States | stripe.com/legal |
| Resend | Sends the account and service emails Probity sends: the notice you ask for when an analysis finishes, purchase confirmations, the account-deletion confirmation, and the verification codes sent to sellers and brokers a buyer invites to upload | The recipient's email address, and each message's subject and body. A buyer's analysis notice is a link back to the Analysis tab (no deal name, company name, or document content); a purchase confirmation names the plan and price; the deletion confirmation carries its PDF; a verification code message carries the code and the inviting buyer's display name | United States | resend.com/legal |
| Sentry (Functional Software, Inc.) | Error monitoring: tells us when the product fails so we can fix it | An error report with the error message, the page or feature where it happened, technical details about the browser or server, and your account's user id. We remove email addresses, request headers, cookies, request bodies, and query strings before a report is sent. No session replay or screen recording | United States | sentry.io/legal |
| Cloudmersive | Virus and malware screening of uploaded files | The uploaded file, sent for scanning and not retained by the provider after the scan | United States | cloudmersive.com/privacy-policy |
| Meta Platforms (Meta Pixel) | Measuring ads and building ad audiences from our public marketing pages | Page viewed, IP address, browser details, cookie or device ID, and a signal that a sign-up was completed. Loaded only for visitors in the United States, and never in the signed-in app, on seller links, or when Global Privacy Control is on | United States / global | facebook.com/privacy/policy |
| Reddit (Reddit Pixel) | Measuring ads and building ad audiences from our public marketing pages | Page viewed, IP address, browser details, cookie or device ID, and a signal that a sign-up was completed. Loaded only for visitors in the United States, and never in the signed-in app, on seller links, or when Global Privacy Control is on | United States / global | reddit.com/policies/privacy-policy |
Questions about this list: hello@useprobity.com.