Subprocessors

StackGrit is operated by Kolliaugu OÜ. To run the service we rely on the third-party providers listed below. Each one only receives the data it needs for its purpose and is bound by a data processing agreement or equivalent terms.

Data transferred outside the European Economic Area is protected by the EU–US Data Privacy Framework where the provider is certified, or by Standard Contractual Clauses. See our Privacy Policy for how we handle your data overall.

Infrastructure and service providers

These providers are used for every StackGrit customer.

• Convex

  United States (AWS us-east-1)

  Application database, backend functions and file storage

  Data: Account and organization data, reports, findings, chat history and uploaded ZIP archives

• Anthropic

  United States

  AI models that run code analysis and project chat

  Data: Source code, git history including commit author names and email addresses, and chat messages

• Railway

  United States (US East)

  Hosting for the analysis workers

  Data: Source code and git history for the duration of an analysis or chat session, deleted afterwards

• Cloudflare

  Global edge network

  Website and app hosting, content delivery and cookieless web analytics

  Data: IP addresses, request metadata and page views

• Sentry

  United States

  Error monitoring for the app and analysis workers

  Data: Error details and stack traces, browser and device information, and the user ID and email address of signed-in users

• Stripe

  United States and European Union

  Payments, subscriptions and invoicing

  Data: Name, email address, billing details and payment card data (collected by Stripe directly)

• Resend

  United States

  Transactional and product emails

  Data: Name, email address, email content and delivery status

• Google

  United States

  Sign in with Google and web font delivery in the app

  Data: Name, email address and profile picture when signing in with Google; IP address when loading fonts

• Microsoft Clarity

  United States

  Session recordings and heatmaps on the stackgrit.com marketing site (not used in the app)

  Data: Page interactions, IP address and device information of website visitors

Integrations you connect

These providers only receive data when you choose to connect them to your organization.

• GitHub

  United States

  Sign in with GitHub, repository access through the StackGrit GitHub App, and creating issues you request

  Data: Profile information, repository contents and metadata, and the text of findings you turn into issues

• Bitbucket (Atlassian)

  United States

  Repository access through a Bitbucket connection

  Data: Workspace and repository metadata and repository contents

Other data recipients

To check your dependencies for known vulnerabilities and outdated versions, the analysis sends dependency names and version numbers from your manifest files to public vulnerability databases (OSV.dev, deps.dev) and package registries such as npm, PyPI and Maven Central. No source code is sent. If the project chat searches the web to answer a question, the search runs through Anthropic and pages are fetched from our analysis workers.

Changes to this list

We update this page before a new subprocessor starts processing customer data. If you'd like to be notified of changes, or need a data processing agreement, contact us at info@stackgrit.com.