Subprocessors
Last updated
These are the companies that process data on Verity's behalf. Session content is redacted on the developer's machine and again on upload before any of them sees it.
| Subprocessor | What it does for Verity | What it holds | Where |
|---|---|---|---|
| Fly.io | Hosting | Transcripts in memory during upload and analysis; nothing at rest | United States (Ashburn, Virginia) |
| Neon | Database | Ids, repository and pull request metadata, settings; no session content | United States (AWS us-east-1) |
| Tigris (through Fly.io) | Object storage | Redacted transcripts (30 days by default) and reports (90 days by default), encrypted at rest | Tigris's global storage, written from Ashburn, Virginia |
| OpenRouter, and the model providers it routes to | Model calls | Redacted excerpts during analysis only, under zero data retention: providers keep no copy | United States |
| PostHog | Product analytics | Usage events sent by our server: pseudonymous ids, counts and page routes; no content, no repo or user names, no browser tracking | United States |
| Better Stack | Logs and uptime | Server logs: ids, counts, durations and error names; no content | United States |
| GitHub | Sign-in and the GitHub App | What GitHub already holds; Verity reads pull requests and posts check runs and comments | GitHub |
Changes to this list
We update this page before a new subprocessor starts processing customer data.
Data processing agreement
To ask for our data processing agreement, email privacy@veritypr.dev.