When you use VitalSentinel we engage the providers below to help deliver the service. This page is the list referred to in Section 14.1 of our Terms and Conditions, which is our Data Processing Agreement, and in Section 9 of our Privacy Policy. Accepting the Terms is your general authorization for us to use them.
| Sub-processor | What we use it for | What it receives | Whose data |
|---|---|---|---|
| Contabo | Server hosting and infrastructure | Everything the service stores runs on these servers: your account, your monitoring configuration, and the measurements collected from your websites. | Your account and your website's visitors |
| Cloudflare | Content delivery, object storage, and protecting sign-in from automated abuse | The IP address of every visitor who downloads one of our tracking scripts, because the script file itself is served from their network. The measurements are sent from the visitor's browser directly to our own servers and do not pass through it. Also holds screenshots and filmstrip frames of pages you ask us to audit and files you attach to support tickets, and its Turnstile check receives the IP address of anyone signing up, signing in, or resetting a password. | Your account and your website's visitors |
| Bird | Sending all our email | Your email address and the full content of every message we send you: account and billing notices, monitoring alerts, onboarding messages, and our newsletter. Our login notification email additionally contains the IP address and device description of the sign-in it is telling you about. | Your account |
| Stripe | Subscription payments, invoices, and the billing portal | Your name, email address, and your subscription and payment details. Card details are entered directly with Stripe and never reach our servers. | Your account |
| Retrieving the search and performance data you authorize us to read | Your Google account email address, your property and page URLs, and the parameters of the reports we request. Covers Google Search Console, Google Analytics, PageSpeed Insights, and the Chrome UX Report. | Your account and your website | |
| Google Calendar | Sending and managing consultation invitations | The booker's name and email address, and the names and email addresses of any additional attendees the booker adds. Google sends the invitation email to each of those addresses on our instruction. The free-text notes from the booking form are not included in the invitation: they stay in our dashboard. | Your account, and any third parties you invite |
| Anthropic | Writing the plain-English summary at the top of an Inspector report | Only the numeric scores and measurements from that one report: the overall and category scores, issue counts, page weight, request count, and load timings. It does not receive the page's address, its content, its text, any screenshot, or anything identifying you or your account. | Neither – no identifying data is sent |
| Ahrefs | Web analytics for our marketing website only | Visits to www.vitalsentinel.com. It is not part of the application and receives nothing about your account or your monitored websites. | Visitors to our own marketing site |
Contabo
Server hosting and infrastructure
Everything the service stores runs on these servers: your account, your monitoring configuration, and the measurements collected from your websites.
Whose data: Your account and your website's visitors
Cloudflare
Content delivery, object storage, and protecting sign-in from automated abuse
The IP address of every visitor who downloads one of our tracking scripts, because the script file itself is served from their network. The measurements are sent from the visitor's browser directly to our own servers and do not pass through it. Also holds screenshots and filmstrip frames of pages you ask us to audit and files you attach to support tickets, and its Turnstile check receives the IP address of anyone signing up, signing in, or resetting a password.
Whose data: Your account and your website's visitors
Bird
Sending all our email
Your email address and the full content of every message we send you: account and billing notices, monitoring alerts, onboarding messages, and our newsletter. Our login notification email additionally contains the IP address and device description of the sign-in it is telling you about.
Whose data: Your account
Stripe
Subscription payments, invoices, and the billing portal
Your name, email address, and your subscription and payment details. Card details are entered directly with Stripe and never reach our servers.
Whose data: Your account
Retrieving the search and performance data you authorize us to read
Your Google account email address, your property and page URLs, and the parameters of the reports we request. Covers Google Search Console, Google Analytics, PageSpeed Insights, and the Chrome UX Report.
Whose data: Your account and your website
Google Calendar
Sending and managing consultation invitations
The booker's name and email address, and the names and email addresses of any additional attendees the booker adds. Google sends the invitation email to each of those addresses on our instruction. The free-text notes from the booking form are not included in the invitation: they stay in our dashboard.
Whose data: Your account, and any third parties you invite
Anthropic
Writing the plain-English summary at the top of an Inspector report
Only the numeric scores and measurements from that one report: the overall and category scores, issue counts, page weight, request count, and load timings. It does not receive the page's address, its content, its text, any screenshot, or anything identifying you or your account.
Whose data: Neither – no identifying data is sent
Ahrefs
Web analytics for our marketing website only
Visits to www.vitalsentinel.com. It is not part of the application and receives nothing about your account or your monitored websites.
Whose data: Visitors to our own marketing site
MaxMind is not on this list
We use MaxMind's GeoLite2 database to turn an IP address into a country. We send them no data. We download the database and perform the lookup on our own servers, so no visitor information ever reaches MaxMind. It is named here because it is easy to assume that an IP geolocation provider receives IP addresses, and this one does not.
Changes to this list
We will give you at least 30 days' notice before adding or replacing a sub-processor, in line with Article 28(2) of the GDPR and Section 14.1 of our Terms. Notice is given by updating this page, and the date at the top of the page tells you when it last changed.
If you want to be told directly rather than checking the page, email privacy@vitalsentinel.com and we will add you to the notification list.
You may object to a change on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected part of the service and receive a pro rata refund, as set out in Section 14.1 of the Terms.
Transfer locations and safeguards
You will notice this list does not yet state, for each provider, the country its data is processed in or the specific transfer safeguard we rely on. That is deliberate, and we would rather say so than publish a guess.
Several of these providers operate in multiple regions and contract through different entities depending on the plan and the account. Reading a head-office address off a vendor's website and presenting it as the processing location for our specific workspace would be inaccurate, and it is exactly the kind of detail a reader would be entitled to rely on. We are working through it provider by provider and will publish the locations and the safeguard relied on for each once each is confirmed.
In the meantime: where we transfer personal data outside the EEA we do so under an adequacy decision or the European Commission's Standard Contractual Clauses, as stated in Section 14.1 of our Terms. If you need the position for a specific provider, or a copy of the safeguard we rely on for it, email privacy@vitalsentinel.com and we will give you what we hold.
Questions
Email privacy@vitalsentinel.com. Related pages: Privacy Policy, Data Processing, and Cookie Policy.