Subprocessors
Every third party that may process customer personal data.
Last updated 2026-10-20
SONAR uses the following subprocessors to operate the service. Each is bound by contract to process personal data on SONAR's instructions and apply the security measures described on the Security page. SONAR will give at least 30 days' advance notice of any addition or replacement.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | LLM inference (Claude) for report generation | United States | SCCs (2021/914) + supplementary measures |
| OpenAI, LLC | LLM fallback (used only when an Anthropic call fails, is refused, or returns unusable output) | United States | SCCs (2021/914) + supplementary measures |
| Supabase, Inc. | Managed Postgres database, Auth, and Storage | European Union (Ireland, AWS eu-west-1) | Data stored in the EU; SCCs (2021/914) for any access by Supabase, Inc. from the United States |
| Render Services, Inc. | Application hosting (web server and background worker) | European Union (Frankfurt, Germany); Render Services, Inc. is a US company | Data hosted in the EU; SCCs (2021/914) for any access from the United States |
| Bright Data Ltd. | Web Unlocker proxy for public-web fetches of KYB sources | Israel | EU Commission adequacy decision (Israel) |
| Stripe Payments Europe, Ltd. | Payment processing (only activated when paid billing is enabled) | Ireland (EU) / United States | SCCs (2021/914); Stripe is itself GDPR-compliant |
| GitHub, Inc. | Storage of weekly database backups, encrypted (AES-256) before upload, kept for 12 weeks | United States | SCCs (2021/914) + supplementary measures (encrypted before upload; GitHub does not hold the key) |
| Telegram FZ-LLC | Admin notification bot (internal ops alerts only). Alerts contain no personal data: accounts and reports are referred to only by internal ID | UAE / global | Not a customer-data subprocessor (internal alerts only; no personal data) |
What counts as a subprocessor
Public registries and sanctions-list sources SONAR queries on customers' behalf — Companies House, INSEE SIRENE, OpenSanctions, Brave Search, KVK Netherlands, ACRA Singapore, KBO Belgium, BrasilAPI, Äriregister, ARES, GLEIF, and the eight sanctions-list publishers (OFAC, EU, UN, UK OFSI, Swiss SECO, Australian DFAT, Canadian OSFI, World Bank) — are NOT subprocessors. SONAR sends them a query about a public subject but does not transmit the customer's personal data to them. They are listed on the Sources page for transparency. Destinations you connect yourself for report alerts (your Slack workspace, Telegram bot, WhatsApp via your Twilio account, or your email recipients) are not SONAR subprocessors either: SONAR sends to them on your instruction. Our uptime monitor only checks that the service responds and receives no personal data.
Changes to this list are announced on this page with a new "Last updated" date. To receive subprocessor-change notices by email, write to privacy@getsonar.report.