Subprocessors
This page lists the companies that process data for Excuto, what each one does, and where it works.
Last updated 2026-11-02
Subprocessors
A subprocessor is a company that handles data on our behalf. For audit data, the customer is the controller and we are the processor. Some of the same companies also help us with account data and billing data. Read the privacy policy for the roles.
The location column states what we have confirmed. "Not confirmed" means that we do not yet know where the provider works.
| Provider | What it does for us | Data it handles | Location | Safeguard |
|---|---|---|---|---|
| Google: Firebase Authentication | Signs you in with email and password or with Google. Sends the verification and reset emails. | Email address, user id, and password in the form that Firebase keeps. Also the name and photo from Google or from the sign-up form. | Not confirmed | Contract: {{SAFEGUARD_GOOGLE}} |
| Google: Cloud Firestore | Stores the database of the service. | Account data, billing data, jobs, findings, and log lines. | United States (nam5 multi-region) | Contract: {{SAFEGUARD_GOOGLE}} |
| Google: Cloud Storage for Firebase | Stores evidence files. | Screenshots, videos, and request records of audited sites. | United States (US-CENTRAL1) | The storage rules deny all access from a browser. Evidence links last 10 minutes. Contract: {{SAFEGUARD_GOOGLE}} |
| Google: Cloud Functions, with Cloud Run and Eventarc | Runs the back end: audits, payments, API, reports, and share links. | The data in each request to our back end. | United States (us-central1). Eventarc: not confirmed. | Contract: {{SAFEGUARD_GOOGLE}} |
| Google: Secret Manager | Holds the Razorpay keys and the webhook secret. | No personal data. | Not confirmed | Contract: {{SAFEGUARD_GOOGLE}} |
| Google: Cloud Logging | Keeps the logs of our functions. | Method, path, and status of API calls. Google can also log request data such as IP addresses. | Not confirmed | Our API logs never hold a header or an API key. Contract: {{SAFEGUARD_GOOGLE}} |
| Razorpay | Takes payment for credits. | Card details, which you enter in the Razorpay form. Your account email. The order amount, the currency, and our order id. | Not confirmed | We never receive your full card number. We accept a payment message only with a valid signature. Contract: {{SAFEGUARD_RAZORPAY}} |
| NVIDIA (hosted models) | Reviews page text and screenshots in AI review. | Visible page text and screenshots of audited sites. Our privacy policy lists exactly what we send. We send no account data. | Not confirmed | A person must approve each AI finding. Contract and data terms: {{SAFEGUARD_NVIDIA}} |
| Vercel | Hosts the web app once it is deployed. | Request data of visitors, such as the page address. This can include the IP address. | Not confirmed | Contract: {{SAFEGUARD_VERCEL}} |
| {{WORKER_HOST_PROVIDER}} | Hosts the machines that run the browser agents. | The pages, screenshots, and videos of an audit, while the audit runs. | {{WORKER_HOST_REGION}} | Each audit runs in its own container. A proxy blocks private network ranges. Contract: {{SAFEGUARD_WORKER_HOST}} |
How we change this list
We post each new subprocessor on this page and change the date at the top, {{SUBPROCESSOR_NOTICE_DAYS}} days before the new subprocessor handles customer data.
If you have a question or an objection, write to {{PRIVACY_EMAIL}}.
Questions
Write to {{CONTACT_EMAIL}}. The other policies: