Subprocessors
The third parties that process customer data on our behalf, what each of them does, and how you find out before that list changes.
What this says.
The list is deliberately short, and it is short because of how the architecture works.
- Four categories of subprocessor: payments, infrastructure and storage, transactional email, and error monitoring.
- None of them receive your source code, because your code never reaches us in the first place.
- We give notice before adding a subprocessor, and DPA customers can object.
- Each entry names what the provider does and what category of data it touches.
This summary is here to be readable. The numbered clauses below are the operative text.
How the list works
What a subprocessor is here
A subprocessor is a third party that processes customer personal data on our behalf in order to deliver the service. Vendors that never touch customer data, such as internal tooling, are not listed.
Why the list is short
Virex is a control plane. Coding agents run on your machines, so your repositories and credentials are never transmitted to us and therefore never reach a subprocessor. What we hold is coordination data, and that narrows the set of providers involved.
Notice and objection
We update this page when the list changes. Customers with an executed DPA receive notice before a new subprocessor begins processing, along with the mechanism to object set out in that agreement.
If you want to be told about changes and do not have a DPA in place, say so through the contact page and we will add you to the notification list.
Regional processing
Where a subprocessor operates across regions, transfers rely on appropriate safeguards. If your organization has a hard residency requirement, raise it before you subscribe. We will tell you plainly whether we can meet it rather than discovering the problem at renewal.
Who processes what.
Named by function. Ask through the contact page if you need the specific entities and their locations for a vendor assessment.
Ask before you sign.
If your legal or procurement team needs something changed, clarified, or evidenced, contact us and we will answer specifically rather than pointing at this page again.