StackArc engages a small number of vetted sub-processors to deliver the Service. This page lists every third party that may process personal information on our behalf, what they process, and where. It is referenced from our Privacy Policy and kept up to date as the Service evolves.
Current sub-processors
Amazon Web Services (AWS)
Privacy policy →- Purpose
- Compute, storage, and managed services hosting the scanning platform and storing scan output.
- Data processed
- Encrypted scan output (no AWS credentials), tenant metadata, account identifiers.
- Location
- Canada — region ca-central-1 (Montreal)
Vercel
Privacy policy →- Purpose
- Hosting and content delivery for the public marketing website at stackarc.io.
- Data processed
- Server logs (IP address, timestamps, user-agent) for ninety days. No personal information from forms.
- Location
- Edge network — closest region to each visitor (Canada/US for North American traffic).
Cloudflare
Privacy policy →- Purpose
- DNS management, email routing for hello@/legal@/privacy@/security@stackarc.io, CDN proxy.
- Data processed
- Inbound email metadata (sender, recipient, timestamps), DNS query logs.
- Location
- Global edge network
How we notify of changes
Material changes (a new sub-processor being added, an existing one being removed, or a change in the data category processed) are notified by email to active customers at least thirty days before the change takes effect. The change is also reflected on this page with an updated “last reviewed” date.
Objection rights
Customers may object to a new sub-processor within thirty days of notification. If an objection cannot be resolved, the customer may terminate the affected service with pro-rata refund of pre-paid fees.
Contact
Questions about sub-processors can be addressed to privacy@stackarc.io.