Sub-processors
The third-party providers Dokven relies on to deliver the Service, with each one's purpose, the data categories involved, and its processing region. We update this page and notify DPA customers when the list changes.
1. About this list
Dokvenuses the third-party providers below ("sub-processors") to host, secure, and power the Service. We require each to protect personal data under written terms consistent with our Data Processing Addendum and Privacy Policy.
This page reflects the current list as of the "Last updated" date above. It is generated from a single source of truth in our codebase so it stays accurate as the product changes.
2. Current sub-processors
| Provider | Purpose | Data categories | Region |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and global edge/CDN delivery. | Request metadata, IP address, account and usage data in transit. | United States (global edge network). |
| Supabase, Inc. | Primary database, authentication, and file/object storage. | Account data, authentication identifiers, Customer Content, scan artifacts. | United States (project region configurable). |
| Stripe, Inc. | Payment processing, subscription billing, and tax calculation. | Name, email, billing details, and card data (held by Stripe — not by Dokven), transaction records. | United States and global. |
| Google LLC (Gemini / Generative Language API) | AI-assisted analysis of submitted content and generation of report findings. | Submitted page content, scan data, and prompts derived from your runs. | United States. |
| Google LLC (PageSpeed Insights / CrUX API) | Real-world performance field-data lookups for performance scans. | Target URLs you submit. | United States. |
| Google LLC (Website Translator widget) | Optional, user-initiated in-browser translation of pages. | Page text rendered in your browser when you choose to translate. | United States. |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring. | Error events, IP address, device/browser data, diagnostic context. | United States. |
| PostHog Inc. | Product analytics, session replay (typed input is masked), and heatmaps. | Usage events, page views, device/browser data, approximate IP-derived location. | United States (us.posthog.com). |
| Upstash, Inc. | Rate limiting and ephemeral response caching (Redis). | IP/identifier-based rate-limit keys and short-lived cached responses. | United States / global. |
| Fly.io, Inc. | Real-browser automation worker that executes Journey Studio and browser-based scans (Playwright). | Target URLs, scan configuration, and generated artifacts (screenshots, video, traces). | United States regions. |
3. Payment processing
Payment and subscription billing is handled by Stripe, Inc.. Card data is entered into, and held by, the payment provider; it does not reach our servers. See the Refund & Billing Policy for details.
4. Changes and notice
How we notify you of changes
Questions about this document? Contact support@dokven.com (legal) or support@dokven.com (privacy). We review and update these policies as the product and the law change; the version and dates above always reflect the current text.