Subprocessors

Vercel or another Node-compatible host may run the Next.js application, API routes, scheduled jobs, and deployment logs.

Cloudflare may be added later for DNS, TLS, CDN, WAF, bot protection, analytics, and edge logs when a custom domain exists.

Managed PostgreSQL stores workspace, user, trace metadata, eval, incident, evidence, billing, audit, and operational job records.

Database backups and restore testing must be configured before live customer data launch.

Better Auth is used for authentication flows within the application.

Lemon Squeezy processes checkout, subscription, customer, and webhook events. Resend may deliver product and notification email when configured.

Sentry may process application errors, traces, releases, source maps, and redacted diagnostic context.

PostHog may process product analytics, masked session replay, structured logs, and LLM analytics metadata according to deployment configuration.

Gemini may be used for eval provider execution when `GEMINI_API_KEY` is configured. Slack and customer webhook destinations may receive notifications configured by workspace administrators.

Outbound integration URLs are validated to reduce SSRF risk and integration secrets are encrypted at rest.