This page lists every third-party service Kliper uses to deliver the platform, what each one processes on your behalf, and the region the data is processed in. We commit to maintaining this list as a current, authoritative record — when we add or remove a subprocessor, this page is updated and a corresponding entry is added to the changelog.
If you have signed a Data Processing Addendum (DPA) with Kort Labs, we will notify your designated contact at least 30 days before adding a new subprocessor that processes personal data.
Last updated: 2026-10-02.
What is a subprocessor?
Under GDPR and similar privacy regulations, a subprocessor is any third party Kort Labs (operator of Kliper) engages to process customer personal data on our behalf. This includes infrastructure providers, AI vendors, analytics platforms, and security tooling.
We distinguish three categories below:
- Active subprocessors — process customer or end-user data.
- Service providers (no customer data) — used to operate Kliper but do not receive customer data.
- Own infrastructure — operated by Kort Labs directly; not third-party subprocessors, listed here for transparency.
Active subprocessors
| Subprocessor | Purpose | Data processed | Processing region | Reference |
|---|---|---|---|---|
| OpenAI, L.L.C. | AI features — the Cortex conversational agent (drafts ROC findings, answers requirement questions, plans remediation), document extraction, autofill drafting, document validation, and file summaries | Prompts containing requirement text, your draft responses, evidence file names, and AI-generated summaries, with PII redacted before sending. Raw file content is sent only when Document Validation is invoked (max 30,000 characters of extracted text) or when you ask Cortex to read an evidence file (one page of about 6,000 characters at a time, virus-scanned files only). | United States | Enterprise privacy — API data is not used to train models. |
| Anthropic, PBC | AI features — the Cortex conversational agent when a Claude model is chosen in the chat’s model picker | The same prompts as the OpenAI row, with PII redacted before sending; raw file content only when you ask Cortex to read an evidence file (one page of about 6,000 characters at a time, virus-scanned files only). | United States | Commercial terms — API data is not used to train models. |
| PostHog Inc. (US entity; EU data hosted via Hetzner Frankfurt) | Product analytics — anonymous event counts (signups, logins, assessments created, evidence uploaded, Cortex messages sent) — and error tracking: unhandled errors in the app and server errors | Pseudonymous user ID, organization ID, organization role, event names, and aggregated event properties (e.g. file size bucket, framework ID). Analytics events never carry file content, file names, requirement text, message bodies, or PII. Session recording and autocapture are explicitly disabled. Error reports carry the error message, stack trace and page path, which can name record identifiers. | European Union (eu.i.posthog.com, Hetzner Frankfurt) |
PostHog DPA — SOC 2 Type II, HIPAA available. |
| Slack Technologies, LLC | Error alerts — server errors are posted to Kort Labs’ internal alert channel so they are seen at once | The error message and stack trace of a server error, which can name record identifiers. Never file content or message bodies by design. | United States | Privacy at Slack — SOC 2 Type II, ISO 27001. |
| Chronicle Security Ireland Ltd. (VirusTotal) | Malware scanning — checks uploaded files against 70+ AV engines | SHA-256 hash only. The file itself is never uploaded to VirusTotal. If the hash is unknown to VirusTotal, the result is treated as clean. | European Union / United States (Google Cloud) | VirusTotal privacy — hash lookups are not personal data; we do not opt into file submission. |
| Polar Software Inc. | Payment processing (Merchant of Record) — subscription checkout, invoices, and tax/VAT | Billing email, organization name, payment method (entered on Polar’s own checkout domain), and invoice line items. Card data never touches Kliper servers — the PCI scope is Polar’s. | United States | Polar — Merchant of Record. |
| Cloudflare, Inc. | DNS, CDN, edge TLS termination, DDoS mitigation, and hosting of this documentation site (docs.kliper.dev, a static Worker), and storage of Kliper’s backups (R2) |
All HTTP request metadata (IP, user agent, path, headers) flows through Cloudflare’s edge. Request bodies are passed through but not stored. The documentation site holds no customer data. R2 holds Kliper’s backups, encrypted with AES-256 by Kliper before upload; Cloudflare holds no key to read them. | Global edge network; request body data terminates at our nginx in Cloudflare’s German region. Backups: R2, EU jurisdiction. | Cloudflare DPA — SOC 2 Type II, ISO 27001. |
| Backblaze, Inc. | Second, immutable copy of Kliper’s backups (Object Lock, 30-day retention) | Backup archives, encrypted with AES-256 by Kliper before upload; Backblaze holds no key to read them. | European Union (EU Central) | Backblaze DPA — SOC 2 Type II. |
| BetterStack (Better Stack S.R.O.) | Status page hosting and uptime monitoring | Public health-check requests to app.kliper.dev/health and other public endpoints. Responses are non-sensitive (HTTP status + JSON health body). No customer data is sent to BetterStack. |
European Union | BetterStack DPA |
Service providers (no customer data)
| Service | Purpose | Why it’s listed | Reference |
|---|---|---|---|
| GitHub, Inc. | Source code hosting (private repository) | Source code only — no production data ever pushed to GitHub. CI workflows run on GitHub-hosted runners but do not have production credentials. | GitHub DPA |
Own infrastructure (operated by Kort Labs)
These components are operated directly by Kort Labs on our own infrastructure, not by a third party. They are listed here for full transparency.
| Component | What it does | Location |
|---|---|---|
| PostgreSQL (primary database) | Stores assessments, evidence metadata, user records | EU — Kort Labs infrastructure (the application server, not reachable from the network) |
| Supabase Auth + Storage (self-hosted) | Authentication backbone and file storage | EU — Kort Labs infrastructure (supabase.kortlabs.xyz) |
| Redis | Session cache, rate-limit counters, queue jobs | EU — Kort Labs infrastructure (redis-db.kliper.local, private network) |
| SMTP relay | Transactional email (password reset, magic links, invitations) | EU — Kort Labs mail server (mail.kortlabs.com) |
| Cortex agent (self-hosted profile, optional) | Kliper supports an optional self-hosted model profile for deployments that require agent prompts to stay on-infrastructure. The standard cloud deployment uses OpenAI or Anthropic (see External subprocessors above). | On-prem / configurable per deployment |
How we vet subprocessors
Before engaging a new subprocessor, we verify:
Independent security attestation
SOC 2 Type II, ISO 27001, or equivalent third-party audit report covering the relevant scope.
Signed Data Processing Addendum
The subprocessor must offer a DPA aligned with GDPR Article 28 (or successor framework).
Data minimization design
We design the integration to send the smallest possible payload. Examples: VirusTotal receives only a SHA-256 hash, PostHog analytics never see file names, and personal data is redacted before any prompt reaches OpenAI.
Regional fit
For EU customer data, we prefer subprocessors that offer EU processing regions. The PostHog deployment is on eu.i.posthog.com for this reason.
Changes to this list
Material changes (additions, removals, region changes) are logged in the changelog. Customers under a DPA receive 30 days’ written notice before a new subprocessor receives their data. Object to a new subprocessor by emailing security@kortlabs.com.