[Legal]
Subprocessors
Last updated October 29, 2026
Panoptes uses the infrastructure providers below to operate the service. Each processes only what its purpose requires. We maintain this list and give notice before adding a subprocessor that would materially change how your data is processed.
01/Current subprocessors
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase | Primary database, authentication and object storage | Account, findings, evidence, reports | AWS sa-east-1 |
| Amazon Web Services (AWS) | Engine compute and S3 storage for scan artifacts and templates | Scan evidence, engagement artifacts | sa-east-1 / us-east-1 |
| Vercel | Hosting and delivery of the marketing site and dashboard | Request metadata (no customer findings at rest) | Global edge |
| Stripe | Payment processing and subscription billing | Billing contact, payment metadata (card data held by Stripe) | United States / global |
| OAuth sign-in (Google) when you choose it | Email and basic profile for authentication | United States / global | |
| GitHub | OAuth sign-in and repository connection for code scanning | Account identity and the repositories you connect | United States / global |
| Slack | Delivery connector when you enable the Slack integration | Finding notifications you route there | United States / global |
| LLM gateway | Model inference for the autonomous engine (enabled per deployment) | Scoped engagement context; never your exfiltrated data | United States / global |
02/Notice of changes
When we intend to add or replace a subprocessor in a way that materially affects the processing of personal data, we will update this page before the change takes effect. If you have a data processing agreement with us, we will give notice as that agreement requires, and you may raise a reasonable objection.
03/Questions
For a data processing agreement or questions about this list, email contact@pnpts.com. Our security practices are described on the Security page.