Who processes your data
Every third party that processes customer data on our behalf, where it runs, and what it receives. We notify customers in writing before adding a subprocessor, as the Data Processing Addendum sets out. Questions: privacy@cybertwin.io.
Fly.io
EU — Frankfurt (fra)
What it does: Application hosting, compute, and the persistent volume holding the database. The sole processor of customer data at rest.
What it receives: All account, environment, finding, and audit-log data; uploaded documents
Anthropic
US
What it does: AI analysis via the Claude API — report narrative, intake follow-up questions, document and diagram analysis, copilot question compilation, and optional configuration-review commentary
What it receives: Profile metadata (industry, size, region, frameworks, budget ceiling) and structured engine output; the free-text intake answers and copilot questions you type; the text, tables and images of documents you choose to upload for document analysis or diagram extraction; and, if you switch on AI commentary for a configuration review, a digest of its findings (check id, severity, title, config section) rather than the configuration file itself. Under Anthropic’s Commercial Terms, Anthropic does not train models on customer content sent through the API. Anthropic’s published policy is to delete API inputs and outputs within 30 days of receipt or generation, keeping them longer only if a request is flagged under its Usage Policy (up to 2 years) or the law requires it. Shorter retention, down to none, needs a separate agreement with Anthropic; we do not have one today.
Clerk
US
What it does: Authentication and session management (SAML single sign-on for Enterprise is not available yet)
What it receives: Auth identifiers (email, hashed password, MFA factors)
Polar
US
What it does: Payment processing and subscription billing (merchant of record — Polar takes the payment and handles VAT; card details never touch CyberTwin)
What it receives: Billing identity (name, email, company), payment method, subscription and invoice records
Resend
Japan (Tokyo, ap-northeast-1)
What it does: Transactional email
What it receives: Recipient email addresses, message content
Sentry
US/EU
What it does: Error monitoring
What it receives: Error message, stack trace and request metadata (route, record ids), scrubbed in our code before the send: email addresses, bearer/API tokens and secret-looking values are redacted; user, org and session identifiers are replaced with short one-way hashes; any field named like a raw upload, config, document or text body is dropped; every string is truncated.
PostHog
EU (eu.i.posthog.com)
What it does: Marketing-site product analytics (EU Cloud)
What it receives: Marketing-page behaviour only. Loaded on public pages exclusively — never inside the authenticated product, so no environment, finding, or exposure data reaches it.
LinkedIn
US/EU
What it does: Ad conversion measurement and audience building (Insight Tag)
What it receives: Marketing-page visit signals for ad attribution. Public pages only — the tag never loads inside the authenticated product.