When you use VitalSentinel we engage the providers below to help deliver the service. This page is the list referred to in Section 14.1 of our Terms and Conditions, which is our Data Processing Agreement, and in Section 9 of our Privacy Policy. Accepting the Terms is your general authorization for us to use them.
| Sub-processor | What we use it for | What it receives | Whose data |
|---|---|---|---|
| Contabo | Server hosting and infrastructure | Everything the service stores runs on these servers: your account, your monitoring configuration, and the measurements collected from your websites. | Your account and your website's visitors |
| Cloudflare | Content delivery, object storage, running the free tools, and protecting sign-in and the free tools from automated abuse | The IP address of every visitor who downloads one of our tracking scripts, because the script file itself is served from their network. The measurements are sent from the visitor's browser directly to our own servers and do not pass through it. Also holds screenshots and filmstrip frames of pages you ask us to audit and files you attach to support tickets, and its Turnstile check receives the IP address of anyone signing up, signing in, resetting a password, or running one of the three free tools that load a page in a real browser. The free tools at vitalsentinel.com/tools run on Cloudflare's network throughout: the usage record of each run is stored in a Cloudflare database, the rate-limit counters live in Cloudflare's key-value store for no more than a day under a salted hash of the caller's IP address (of its /64 network prefix, for IPv6), the address entered into the three browser-based tools is sent to Cloudflare's Browser Rendering service, and the AI agent readiness check resolves the hostname being checked through Cloudflare's public DNS resolver. The Inspector page audit adds one more use: its report, filmstrip and screenshot are stored for 30 days in Cloudflare object storage created with EU jurisdiction, so those stored files are held in the EU. No model writes any part of that report. The summary at the top of it is composed from the scores this site computed, so nothing about the page you audit is sent to an AI service. | Your account, your website's visitors, and anyone who uses our free tools |
| Bird | Sending all our email | Your email address and the full content of every message we send you: account and billing notices, monitoring alerts, onboarding messages, and our newsletter. Our login notification email additionally contains the IP address and device description of the sign-in it is telling you about. | Your account |
| Stripe | Subscription payments, invoices, and the billing portal | Your name, email address, and your subscription and payment details. Card details are entered directly with Stripe and never reach our servers. | Your account |
| Retrieving the search and performance data you authorize us to read | Your Google account email address, your property and page URLs, and the parameters of the reports we request. Covers Google Search Console, Google Analytics, PageSpeed Insights, and the Chrome UX Report. The two free Chrome UX Report tools also send Google the address being looked up, and any competitor addresses entered alongside it, with no account involved. The free Inspector page audit at vitalsentinel.com/tools/inspector sends Google the address being audited twice over, once to the Chrome UX Report for field data and once to PageSpeed Insights, which runs the Lighthouse half of the audit on Google's own infrastructure, also with no account involved. | Your account and your website | |
| Google Calendar | Sending and managing consultation invitations | The booker's name and email address, and the names and email addresses of any additional attendees the booker adds. Google sends the invitation email to each of those addresses on our instruction. The free-text notes from the booking form are not included in the invitation: they stay in our dashboard. | Your account, and any third parties you invite |
| Anthropic | Writing the plain-English summary at the top of an Inspector report inside the app | Only the numeric scores and measurements from that one report: the overall and category scores, issue counts, page weight, request count, and load timings. It does not receive the page's address, its content, its text, any screenshot, or anything identifying you or your account. This covers the Inspector inside the application at app.vitalsentinel.com. The free Inspector page audit at vitalsentinel.com/tools/inspector is a separate tool that uses no model at all: its summary is composed from the scores that tool computed, so nothing from it reaches Anthropic or any other AI service. | Neither – no identifying data is sent |
| Ahrefs | Web analytics for our marketing website only | Visits to www.vitalsentinel.com. It is not part of the application and receives nothing about your account or your monitored websites. | Visitors to our own marketing site |
| hstspreload.org | Checking whether a domain is on the HSTS preload list | The domain entered into our free HSTS validator, and nothing else. The service is run by the Chromium project, the lookup is made from our servers rather than from your browser, and it receives nothing about the person who ran the check and nothing about any account. | Neither – only the domain being checked is sent |
| TLD registration lookup services (RDAP) | Reading the public registration record of a domain being audited | The domain being audited by our free Inspector, and nothing else. The lookup goes to the RDAP service that IANA's bootstrap registry publishes for that top-level domain, for example rdap.verisign.com for .com, so which registry answers depends on the domain; a top-level domain with no RDAP service is not queried at all. The lookup is made from our servers rather than from your browser, and the registry receives nothing about the person who ran the check and nothing about any account. | Neither – only the domain being audited is sent |
Contabo
Server hosting and infrastructure
Everything the service stores runs on these servers: your account, your monitoring configuration, and the measurements collected from your websites.
Whose data: Your account and your website's visitors
Cloudflare
Content delivery, object storage, running the free tools, and protecting sign-in and the free tools from automated abuse
The IP address of every visitor who downloads one of our tracking scripts, because the script file itself is served from their network. The measurements are sent from the visitor's browser directly to our own servers and do not pass through it. Also holds screenshots and filmstrip frames of pages you ask us to audit and files you attach to support tickets, and its Turnstile check receives the IP address of anyone signing up, signing in, resetting a password, or running one of the three free tools that load a page in a real browser. The free tools at vitalsentinel.com/tools run on Cloudflare's network throughout: the usage record of each run is stored in a Cloudflare database, the rate-limit counters live in Cloudflare's key-value store for no more than a day under a salted hash of the caller's IP address (of its /64 network prefix, for IPv6), the address entered into the three browser-based tools is sent to Cloudflare's Browser Rendering service, and the AI agent readiness check resolves the hostname being checked through Cloudflare's public DNS resolver. The Inspector page audit adds one more use: its report, filmstrip and screenshot are stored for 30 days in Cloudflare object storage created with EU jurisdiction, so those stored files are held in the EU. No model writes any part of that report. The summary at the top of it is composed from the scores this site computed, so nothing about the page you audit is sent to an AI service.
Whose data: Your account, your website's visitors, and anyone who uses our free tools
Bird
Sending all our email
Your email address and the full content of every message we send you: account and billing notices, monitoring alerts, onboarding messages, and our newsletter. Our login notification email additionally contains the IP address and device description of the sign-in it is telling you about.
Whose data: Your account
Stripe
Subscription payments, invoices, and the billing portal
Your name, email address, and your subscription and payment details. Card details are entered directly with Stripe and never reach our servers.
Whose data: Your account
Retrieving the search and performance data you authorize us to read
Your Google account email address, your property and page URLs, and the parameters of the reports we request. Covers Google Search Console, Google Analytics, PageSpeed Insights, and the Chrome UX Report. The two free Chrome UX Report tools also send Google the address being looked up, and any competitor addresses entered alongside it, with no account involved. The free Inspector page audit at vitalsentinel.com/tools/inspector sends Google the address being audited twice over, once to the Chrome UX Report for field data and once to PageSpeed Insights, which runs the Lighthouse half of the audit on Google's own infrastructure, also with no account involved.
Whose data: Your account and your website
Google Calendar
Sending and managing consultation invitations
The booker's name and email address, and the names and email addresses of any additional attendees the booker adds. Google sends the invitation email to each of those addresses on our instruction. The free-text notes from the booking form are not included in the invitation: they stay in our dashboard.
Whose data: Your account, and any third parties you invite
Anthropic
Writing the plain-English summary at the top of an Inspector report inside the app
Only the numeric scores and measurements from that one report: the overall and category scores, issue counts, page weight, request count, and load timings. It does not receive the page's address, its content, its text, any screenshot, or anything identifying you or your account. This covers the Inspector inside the application at app.vitalsentinel.com. The free Inspector page audit at vitalsentinel.com/tools/inspector is a separate tool that uses no model at all: its summary is composed from the scores that tool computed, so nothing from it reaches Anthropic or any other AI service.
Whose data: Neither – no identifying data is sent
Ahrefs
Web analytics for our marketing website only
Visits to www.vitalsentinel.com. It is not part of the application and receives nothing about your account or your monitored websites.
Whose data: Visitors to our own marketing site
hstspreload.org
Checking whether a domain is on the HSTS preload list
The domain entered into our free HSTS validator, and nothing else. The service is run by the Chromium project, the lookup is made from our servers rather than from your browser, and it receives nothing about the person who ran the check and nothing about any account.
Whose data: Neither – only the domain being checked is sent
TLD registration lookup services (RDAP)
Reading the public registration record of a domain being audited
The domain being audited by our free Inspector, and nothing else. The lookup goes to the RDAP service that IANA's bootstrap registry publishes for that top-level domain, for example rdap.verisign.com for .com, so which registry answers depends on the domain; a top-level domain with no RDAP service is not queried at all. The lookup is made from our servers rather than from your browser, and the registry receives nothing about the person who ran the check and nothing about any account.
Whose data: Neither – only the domain being audited is sent
MaxMind is not on this list
We use MaxMind's GeoLite2 database to turn an IP address into a country. We send them no data. We download the database and perform the lookup on our own servers, so no visitor information ever reaches MaxMind. It is named here because it is easy to assume that an IP geolocation provider receives IP addresses, and this one does not.
Changes to this list
We will give you at least 30 days' notice before adding or replacing a sub-processor, in line with Article 28(2) of the GDPR and Section 14.1 of our Terms. Notice is given by updating this page, and the date at the top of the page tells you when it last changed.
The free tools at vitalsentinel.com/tools brought four of the providers listed here with them: Cloudflare's Browser Rendering service, Cloudflare's public DNS resolver, hstspreload.org, and the domain registration lookup services (RDAP) published for each top-level domain. None of them receives anything from a customer account or from a monitored website. Each receives only the address or hostname someone typed into a free tool, which is why they do not process customer data on our behalf and the 30 days' notice above applies to sub-processors that do. That notice, and the objection right described below, apply unchanged to every future addition.
If you want to be told directly rather than checking the page, email privacy@vitalsentinel.com and we will add you to the notification list.
You may object to a change on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected part of the service and receive a pro rata refund, as set out in Section 14.1 of the Terms.
Transfer locations and safeguards
You will notice this list does not yet state, for each provider, the country its data is processed in or the specific transfer safeguard we rely on. That is deliberate, and we would rather say so than publish a guess.
Several of these providers operate in multiple regions and contract through different entities depending on the plan and the account. Reading a head-office address off a vendor's website and presenting it as the processing location for our specific workspace would be inaccurate, and it is exactly the kind of detail a reader would be entitled to rely on. We are working through it provider by provider and will publish the locations and the safeguard relied on for each once each is confirmed.
In the meantime: where we transfer personal data outside the EEA we do so under an adequacy decision or the European Commission's Standard Contractual Clauses, as stated in Section 14.1 of our Terms. If you need the position for a specific provider, or a copy of the safeguard we rely on for it, email privacy@vitalsentinel.com and we will give you what we hold.
Questions
Email privacy@vitalsentinel.com. Related pages: Privacy Policy, Data Processing, and Cookie Policy.