Unfenced - Subprocessors

Last updated: 21 October 2026

Unfenced uses the third-party providers ("subprocessors") below to run the Service. This list is referenced by the Privacy Policy and the Data Processing Addendum. We update it when subprocessors change; DPA customers are notified per the DPA.

Current subprocessors

Subprocessor	Purpose	Personal data processed	Region
Supabase	Managed PostgreSQL database, authentication, and storage. Holds account profiles (email), sealed credentials and TOTP seeds, sealed browser sessions, fetch logs (URLs, titles, user-agent), recordings, and usage events.	Account email; sealed credentials/session cookies; fetched URLs and titles; usage metadata.	EU (PostgreSQL region eu-central-1)
Cloudflare	Object storage for session-replay screenshot frames (R2 bucket `unfenced-sessions`), and the tunnel that fronts the fetch/act worker.	Session-replay frames (may depict page content); network transit for requests (no user IP is stored).	EU (R2 EU jurisdiction)
Fly.io	Hosting for the public website and dashboard, API forwarding, and control services. Replaces Vercel web hosting; Vercel analytics collectors have been removed.	Website and dashboard requests; authenticated API traffic in transit. Signup IP addresses are used transiently for a country estimate; the web process does not persist them.	Web and control Machines configured in Frankfurt, Germany (fra).
Microsoft Clarity	Dashboard session recordings and interaction analytics after consent.	Dashboard DOM (ordinary text visible; inputs, displayed API keys, and token-bearing links masked), interaction events, and page metadata. See the Cookie Notice.	Provider processing region and transfer mechanism to be confirmed by counsel.
Google	Google Tag Manager and Google Analytics measurement for marketing page views and beta-signup events.	Page-view and beta-signup measurement events. Google may process request metadata under its own service terms and privacy policy.	US. Transfer mechanism and provider terms to be confirmed by counsel.
Reddit	Advertising conversion measurement through the configured GTM container.	Marketing page-view and beta-signup measurement events. Reddit may process request metadata under its own service terms and privacy policy.	US. Transfer mechanism and provider terms to be confirmed by counsel.
Meta	Meta Pixel and Conversions API parameter builder loaded by the configured GTM container on public marketing pages.	Marketing request metadata and, for configured events, browser and click identifiers such as `_fbp` and `_fbc`.	US. Transfer mechanism and provider terms to be confirmed by counsel.
Anthropic	AI model for an optional demo agent only. Currently OFF in production - engaged only if the operator explicitly enables it, and then disclosed.	Only the request content routed to the demo agent when enabled. Persistent stored secrets are never sent to the model.	US. Standard Contractual Clauses. Engaged only if the optional demo agent is enabled, which it is not in production.
Compute host (Leaseweb)	The always-on worker box (`eu-west`). All processing happens here: the browser pool and the on-disk Chrome profiles, the credential vault and the sealed session vault in use, the signed audit chain, the fetch log, and every page the Service fetches or acts on for you.	Everything the Service processes, including decrypted credentials at the moment they are filled into a page.	Netherlands. This is the authoritative answer: `UNFENCED_PLACES` declares `eu-west:NL` and that value is the only source of a machine's location in the product. An older example in `docs/DEPLOY.md` said "Frankfurt"; it was wrong and has been corrected.
Residential egress proxy	The exit IP the Service fetches pages through, so a request looks like a person's connection rather than a datacenter's. Cloud mode refuses to start without one unless the operator sets `UNFENCED_ALLOW_NO_PROXY=1`.	The fetched-page traffic itself - the URLs requested on your behalf and their responses, in transit.	Depends on the provider the operator configures. Named to a customer on request to privacy@unfenced.ai, and disclosed here before any change that affects the hosted service. A self-hosted operator chooses their own provider and is the controller of that choice.

Conditional subprocessors

Dormant unless the operator turns them on. Where one is enabled, it is a subprocessor of the data in its row and this list must say so for that deployment.

Subprocessor	Engaged when	Personal data processed
Anthropic	The optional demo agent is enabled (`ANTHROPIC_API_KEY`).	Only the request content routed to the demo agent. Persistent stored secrets are never sent to the model.
ntfy	A summons channel of type `ntfy` is configured.	The verb and the site host of the action awaiting you, plus a dashboard link. No page URL, no account id, no secret.
Telegram	A summons channel of type `telegram` is configured.	The same summons text as above, to the chat you name.
Resend	Transactional email is enabled (`RESEND_API_KEY`).	The recipient's email address and the message (waitlist and invite mail).
Stripe	Billing is enabled (`STRIPE_SECRET_KEY`).	Billing and customer data, handled by Stripe. Card details never reach us.
Your own webhook	You configure a summons callback of type `json`.	Richer than the others by design: the page URL, the agent's stated reason, and the session id. If you point it at Slack or Discord, that vendor becomes a recipient of that payload and yours to disclose.
PostHog	`VITE_POSTHOG_KEY` is configured on `app.unfenced.ai` and you consent to dashboard analytics.	Dashboard DOM (ordinary text visible; inputs, displayed API keys, key-bearing snippets, and token-bearing links masked), interaction events, session recordings, page metadata, signed-in user ID, display name and email, limited fetch and activation events, onboarding stages and outcomes, bounded request-failure fields, and fixed-message render-failure issues, EU-hosted. See the Cookie Notice.

Notes

EU data residency. The primary stores (Supabase database, Cloudflare R2) are configured for the EU, and the compute host is in the Netherlands. Where a subprocessor processes data outside the EEA, we rely on an approved transfer mechanism (e.g. Standard Contractual Clauses); see Privacy Policy §7 and DPA §10.
No IP in the record. No table holds an IP address, and Cloudflare handles network transit without us persisting an end-user IP. The worker's process log does not record one either: its request lines carry the method and a redacted path and nothing that identifies the connection; see Privacy Policy §11.
Dashboard text is visible in replays. Inputs and marked key or token displays are masked in both recorders (packages/ui/src/components/Consent.tsx).
PostHog is a new subprocessor, added 1 October 2026. There are no customers yet, so no DPA-signed customers to notify before engaging it on the hosted product. Before onboarding any DPA-signed customer, ensure this list and the required notice process reflect the providers in use. Future additions or replacements remain subject to Changes to this list, below.
This list is derived from the code. docs/SUBPROCESSORS.md is the engineering ledger, with a file:line citation for every row; the two are meant to agree. Before publishing, diff them - the compute host and the egress proxy were in that ledger and missing here, which is how the gap was found.

Changes to this list

We give 30 days' notice before adding or replacing a subprocessor: by email to the account address on file, and by updating this page, which is the canonical record and carries its own "Last updated" date.

A business customer under the Data Processing Addendum may object on reasonable data-protection grounds within that notice period. If we cannot resolve the objection, the customer may terminate the affected part of the Service without penalty. This matches DPA Section 6, and the two are written to say the same thing; if they ever diverge, the DPA governs for customers who have signed it.

Contact

Questions about subprocessors: privacy@unfenced.ai.