Subprocessors
Last updated 23 August 2026
Everyone we rely on, and exactly what each of them can see. We give 30 days’ notice before this list changes.
Nothing sits in the challenge path
The interesting entry on this page is the one that is missing. Issuing a challenge, grading an answer and redeeming a token involve no third party at all — no CDN that terminates the request, no analytics, no logging vendor, no ad network, no machine learning API. The request reaches our server and stops there. Every subprocessor below touches billing, email, or the boxes the service runs on. None of them sees challenge traffic content, because there is no content to see.
Current subprocessors
To be completed before launch with the vendors actually contracted. The categories are fixed by the architecture; the names are not yet.
| Purpose | Provider | Location | What it can access |
|---|---|---|---|
| Compute and hosting | [provider] | [region] | Runs the server process. Encrypted volumes; the daily usage counters and account records at rest. |
| Transactional email | [provider] | [region] | Account holder email addresses, for the site secret and service notices. No visitor data. |
| Payments | [provider] | [region] | Billing name, address, and card data, as an independent controller. We never see full card numbers. |
| Error monitoring | [provider or "none"] | [region] | Stack traces and request paths. Configured to scrub request bodies and headers. |
What is deliberately not on this list
| Category | Why not |
|---|---|
| Analytics and product telemetry | The marketing site runs none, and the widget reports nothing back beyond the challenge and answer calls it must make. |
| CDN in front of the API | A CDN terminating TLS would see every request. The API is served directly. Static assets may sit behind one; challenge traffic will not. |
| Advertising and attribution | We do not run ads and have nothing to attribute. |
| Third-party CAPTCHA or risk scoring | The mechanism is ours end to end. No request is forwarded to another vendor for scoring. |
| Machine learning APIs | Challenges are generated arithmetically. No model is invoked at request time. |
Notice of changes
We give at least 30 days’ notice before adding or replacing a subprocessor. To be told, email privacy@blockagents.ai with the subject “subprocessor notifications”. Objection and termination rights are in section 5 of the DPA.