How to read this list
A sub-processor is a third party that processes data on our behalf so that we can deliver the service. We hold a written data processing agreement with each, and we remain answerable to you where one fails to meet its obligations.
Not every provider listed is used for every customer. The payment provider, for instance, is only involved when you pay.
This page shows the current list. The "last updated" field at the top of the page tracks when it changed.
How we choose them
Before a provider goes on this list we look at: whether it offers a data processing agreement, where data is held, its encryption and access control practices, whether it has passed an independent security audit, and its breach notification commitment.
Where a provider does not meet these criteria, we do the work ourselves or we do not offer that feature.
Hosting and infrastructure
Provider: [Hosting provider]. Purpose: running the site and the panel, application database.
Data location: [Region]. Data processed: account details, scope and order records, panel session data.
Recording and file storage
Provider: [Object storage provider]. Purpose: storing evidence for findings — screen recordings, console and network logs, screenshots.
Data location: [Region]. Retention: permanent deletion 90 days after a test ends. Encrypted at rest.
Payment
Provider: [Payment provider]. Purpose: taking card payments and processing billing details.
We neither see nor store your card number; the payment page belongs to the provider. We hold only the transaction reference and the last four digits.
Email and notifications
Provider: [Email provider]. Purpose: transactional email — scope confirmation, test start and finish notices, report-ready notice, password reset.
Data processed: name and email address, message subject and delivery status.
Support
Provider: [Support desk provider]. Purpose: recording and answering support requests.
Data processed: correspondence content, name, email and any files you attach. Retention: deleted 24 months after the request closes.
Measurement
Provider: [Analytics provider]. Purpose: measuring which pages on the site are viewed.
It runs only if you have allowed measurement cookies. If you have not, no request reaches this provider at all.
The tester network
The testers who carry out testing are independent people affiliated with us, and they count as sub-processors.
Every tester signs an agreement covering confidentiality and data protection before being assigned to any test. We are directly answerable for a tester’s breach.
Access is granted per test and for its duration only; it is revoked when the test ends.
Which country a tester is in varies with the geographic scope of the test. If you do not want testers from particular countries, you can state that in the scope.
Transfer safeguards
Transfers to providers located abroad are made under standard contractual clauses or the other mechanisms the applicable legislation provides.
We share a copy of the safeguard we rely on upon request.
Change notification
We give at least 30 days’ notice by email and in the panel before adding a new sub-processor or replacing an existing one.
The notice states the provider’s name, the purpose it serves and where data is located.
Your right to object
You may object on reasonable grounds within the notice period. We first try to meet your objection with an alternative arrangement.
Where we cannot, you may end the affected service without penalty and receive a refund of the part not carried out.
These documents are published in English and Turkish. In the event of conflict the Turkish text prevails.