AnnexProof
App sub-processors
When you use the AnnexProof app (app.annexproof.com), these providers process your organisation's data on our behalf.
1. Sub-processors
- Vercel Inc. (USA): app hosting and server code; region fra1, Frankfurt.
- Supabase Inc. (USA): database and user sign-in; region eu-central-1, Frankfurt.
- Amazon Web Services (USA): the Evidence Vault, which holds evidence files, and copies of the audit log checkpoints; region eu-central-1, Frankfurt.
- Resend (Plus Five Five, Inc.), USA: sending emails from the app, such as invitations, deadline reminders and Brand Radar notifications; sending servers in the USA.
2. Transfers to the US
We store data in EU regions. All four providers belong to groups based in the US, however, so data may be transferred to the US.
3. Public vulnerability databases
Vulnerability monitoring and Brand Radar send only identifiers to public databases: component PURLs to OSV, CPEs and brand names to NVD, CVE numbers to EPSS, and vendor and product names to ENISA EUVD. The CISA KEV catalogue is downloaded whole. OSV, NVD, EPSS and CISA KEV are run by US organisations. These databases do not process data on our behalf, so they are not sub-processors.
4. The annexproof.com website
The forms on this website, contact and CRA Snapshot, are covered by the privacy policy.