Sub-processors
Who processes your data.
These are the third-party services PkgRadar relies on to deliver the product, the data each one receives, and where it is processed. This page is the canonical list a Data Processing Agreement can reference.
Last reviewed August 20, 2026.
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| Stripe | Subscription billing & webhook signing | Email, payment method (Stripe-tokenised) | US / EU |
| Resend | Transactional email (sign-in, alerts) | Email address, message body | US |
| Cloudflare | Edge TLS termination + tunnel ingress | Request metadata; no body retention | Global edge |
| DigitalOcean | Compute hosting + managed database | Application + scan database | US (NYC) |
| Google Analytics | Aggregate web analytics (marketing site) | Pseudonymous usage events; no scan data or source code | US / Global |
Scope & commitments
What this list means
PkgRadar does not sell customer data and shares it with sub-processors only to run the service. The packages we scan are public open-source artifacts fetched from their registries; your scan history and account data stay in our own database and are not passed to analytics or advertising vendors.
We inspect packages statically — the scanner never runs package install scripts or build steps — so no customer source code or private package contents are executed or forwarded to a third party in the course of a scan.
For customers under a signed Data Processing Agreement, we notify the account contact of a material change to this list — a new sub-processor with access to customer data — before that change takes effect, so you have the opportunity to review it. This page always reflects the current list.
Procurement
Need a DPA or a security review?
See the Trust & compliancepage for how our evidence maps to SOC 2, NIST SSDF, ISO 27001, the EU CRA, and SLSA, or reach us directly for a DPA or security questionnaire.