For the data involved in running an audit, ZeroRecall (Astro Tasarım Simay Yenice) acts as a processor on behalf of the customer, who is the controller. To run the service we use the infrastructure providers (sub-processors) listed below, each under a data processing agreement or equivalent contractual terms. Data is transferred to them only to the extent the service requires.
| Provider | What data | Purpose | Location |
|---|---|---|---|
| Vercel | Application traffic, page requests, cached static content | Application hosting and content delivery (CDN) | Outside Türkiye/EU |
| Supabase | Account data (email, session token), audit records, findings and evidence file metadata | Authentication and Postgres database hosting | Outside Türkiye/EU |
| Creem | Billing information and subscription status (card data never reaches us) | Payment collection and invoicing (Merchant of Record) | Outside Türkiye/EU |
| Anthropic (Claude API) | Ambiguous audit findings sent for a second opinion (LLM-judge) | Optional judge layer for gray-area findings; only used if enabled on your audit | Outside Türkiye/EU |
| Google (OAuth via Supabase Auth) | Name, email and profile data returned by Google sign-in | Optional "Continue with Google" sign-in; currently disabled in our auth dashboard | Outside Türkiye/EU |
What is not a sub-processor
The AI system you choose to audit (your chat endpoint, RAG pipeline, or vector store) is your infrastructure, connected at runtime with credentials you provide. It is not a ZeroRecall sub-processor: we do not choose it, store its data beyond the run, or use it for any purpose other than the audit you requested. Connector secrets are used in memory only and are never written to the evidence file or persistent storage.
Updates and notice
This list is updated whenever the providers we use change; the date at the top of the page reflects the current list. If you are party to our Data Processing Agreement, we update this page before adding a new sub-processor, and you can request direct notice at hello@zerorecall.ai; your right to object is set out in the DPA.