How to read this list
A sub-processor is a third party that processes data on our behalf so that we can deliver the service. We hold a written data processing agreement with each, and we remain answerable to you where one fails to meet its obligations.
Not every provider listed is used for every customer. The payment provider, for instance, is only involved when you pay.
This page shows the current list. The "last updated" field at the top of the page tracks when it changed.
How we choose them
Before a provider goes on this list we look at: whether it offers a data processing agreement, where data is held, its encryption and access control practices, whether it has passed an independent security audit, and its breach notification commitment.
Where a provider does not meet these criteria, we do the work ourselves or we do not offer that feature.
Hosting and infrastructure
Purpose: running the site and the panel, application database. We use commercial hosting and server providers for this.
Data processed: account details, scope and order records, panel session data.
Recording and file storage
Purpose: storing evidence for findings — screen recordings, console and network logs, screenshots. We use an object storage service for this.
Retention: permanent deletion 90 days after a test ends. Encrypted at rest.
Payment
Provider: Kuveyt Türk (virtual POS), Türkiye. Purpose: taking card payments and processing billing details.
Card details are entered on our own screen and passed through our servers to the bank; the full card number, the expiry date and the security code are not written to any record or log. The bank carries out 3-D Secure verification; you are never taken to the provider’s own site. Our payment records hold the bank’s transaction reference, and our audit records hold the last four digits of the card.
Email and notifications
Purpose: transactional email sent through an email delivery service — scope confirmation, test start and finish notices, report-ready notice, password reset.
Data processed: name and email address, message subject and delivery status.
Push notifications
Provider: Google Firebase Cloud Messaging. Purpose: sending push notifications to the mobile app — test start and finish notices, report-ready notice.
Data processed: the device notification token and the content of the message. Google’s servers are abroad; the safeguards are in the transfers section below.
Support
Purpose: recording and answering support requests, for which we use a support desk service.
Data processed: correspondence content, name, email and any files you attach. Retention: deleted 24 months after the request closes.
Measurement
Provider: Google Ireland Limited (Google Analytics 4). Purpose: measuring which pages on the site are viewed, how long a visit lasts and which route brought the visitor here.
It starts the moment you arrive; we do not ask separately. What the panel sends is narrowed: the matched route instead of the address, no query string, and a fixed page title.
Data processed: page address and title, referring address, language, approximate location (from the IP, with the last octet discarded), device and browser details, and a random visitor identifier created in a first-party cookie. Advertising personalisation and ad data sharing are sent as denied.
Data location: Google servers, which means a transfer abroad; the safeguards are in the transfers section of the Privacy Policy.
The tester network
The testers who carry out testing are independent people affiliated with us, and they count as sub-processors.
Every tester signs an agreement covering confidentiality and data protection before being assigned to any test. We are directly answerable for a tester’s breach.
Access is granted per test and for its duration only; it is revoked when the test ends.
Which country a tester is in varies with the geographic scope of the test. If you do not want testers from particular countries, you can state that in the scope.
Transfer safeguards
Transfers to providers located abroad are made under standard contractual clauses or the other mechanisms the applicable legislation provides.
We share a copy of the safeguard we rely on upon request.
Change notification
We give at least 30 days’ notice by email and in the panel before adding a new sub-processor or replacing an existing one.
The notice states the provider’s name, the purpose it serves and where data is located.
Your right to object
You may object on reasonable grounds within the notice period. We first try to meet your objection with an alternative arrangement.
Where we cannot, you may end the affected service without penalty and receive a refund of the part not carried out.
These documents are published in English and Turkish. In the event of conflict the Turkish text prevails.