Subprocessors
Last updated: 5 August 2026
Everace AB uses the third parties below to operate Cogbird. Each receives only what is listed, and each is bound by a data processing agreement. Transfers outside the EU rely on Standard Contractual Clauses.
We will update this page before adding a new subprocessor. To be told when that happens, write to hello@everace.co.
Subprocessors
| Who | What for | What they receive | Where |
|---|---|---|---|
| Hetzner Online GmbH | Servers and the database. Everything is stored here. | All of it — account data, search data, crawled page content. | Germany / Finland (EU) |
| Cloudflare, Inc. | DNS and proxy in front of the application. | Request metadata in transit. No stored data. | Global edge; EU entity Cloudflare Germany GmbH |
| Anthropic PBC | Writes the one explanatory paragraph on a surfaced suggestion, and classifies pages by type. This is the subprocessor most worth reading twice. | Page titles, URLs, extracted headings and the numeric evidence behind a finding. Not full page bodies, and never Search Console credentials. | United States |
| OpenAI, L.L.C. | Embeddings only — turning text into vectors so four comparisons can see past paraphrase. No prose is generated here and no judgement is made here. | Short text fragments: titles, headings, query strings. | United States |
| DataForSEO LLC | Competitor discovery and result-page measurement. | Query strings and domain names. No account data and no page content. | United States |
| Resend, Inc. | Transactional email — verification, password resets, verdict notifications. | Name, email address, and the contents of those messages. | United States |
| Stripe, Inc. | Payments and subscription billing. | Billing name, email, address and payment details. We never see card numbers. | United States / Ireland |
| PostHog, Inc. | Crash reports and which screens get used, so a broken page is found before somebody writes in about it. | The path of the page visited, browser and device type, and the message and stack of any error. Not the query string — it carries invite and password-reset tokens — and not the contents of any screen: autocapture and session recording are both switched off, so no domain, query or suggestion of yours is sent. | EU region (Frankfurt). Data does not leave the EU. |
Sources you connect, which are not subprocessors
These are the other direction. You authorise us to read from them, using a grant you issue and can revoke without involving us — so they receive nothing from us that was not already theirs.
- Google Search Console — Read-only, on a grant you issue and can revoke in your Google account at any time.
- Bing Webmaster Tools — Read-only, on an API key you paste and can rotate at any time.
Where the rest of it lives
Everything not listed above — the database, the pages we crawled, the ledger of what was shipped — is stored on servers in the EU and is not shared with anyone. See the privacy policy for how long, and for the two model providers that are worth reading about in full.