Sub-processors

Last updated 2026-10-09

Evident Access uses these companies to run the service. Each has a data processing agreement with us that protects the data at least as well as our data processing agreement with you.

Company	What it does for us	Data it handles	Where
Cloudflare, Inc.	Hosting, database, background jobs, the browser that scans pages, bot checks, receiving email sent to hello@evidentaccess.com	All service data: accounts, sites, scan results, statements, logs	Company in the USA. Database stored in Western Europe; requests and scans run on Cloudflare's global network.
Resend	Sending email (sign-in links, scan alerts, monthly reminders)	Email address and the content of each email, such as site names and issue counts	Company in the USA. Email is sent from the EU (Ireland).
Stripe Payments Europe, Limited	Payments, invoices and the billing portal	Billing name, address, email, VAT ID and payment details	Ireland, with processing in the USA and other countries where Stripe operates

Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Changes

We email account holders at least 30 days before we add or replace a sub-processor. If you object, tell us at hello@evidentaccess.com; if we cannot address the objection, you can cancel and we refund fees paid for the time after the change.