Sub-processors

1.Current sub-processors

These companies process personal data on our behalf to run RuleFix. Each is bound by a written agreement with confidentiality and security obligations at least as protective as our DPA.

• Supabase, Inc.In use

  Purpose

  Database, authentication and file storage. Sends sign-in and verification emails until our own email provider is live.

  Personal data

  Account and profile data, workspace data, projects, scan results and findings (code excerpts encrypted by RuleFix before storage), consent records, authentication logs (including IP address and browser).

  Location

  [Mumbai, India (AWS ap-south-1) — region to be confirmed]

• Vercel, Inc.In use

  Purpose

  Application hosting, content delivery and request processing.

  Personal data

  All data in transit through the service, including code sent for scanning (processed in memory, not stored); request logs (IP address, browser, URL).

  Location

  [Vercel function region to be confirmed]; static pages are served from Vercel's global edge network

• Anthropic, PBCIn use when enabled

  Purpose

  Generates suggested code fixes when an AI fix is requested.Only when you or your agent request an AI fix and AI fixes are enabled. Otherwise no code is sent.

  Personal data

  A window of up to about 120 lines around one finding, with secret values redacted by RuleFix first; the rule being fixed.

  Location

  United States

• GitHub, Inc.In use when enabled

  Purpose

  Reads repositories you connect through the RuleFix GitHub App, so we can scan them.Only if your workspace installs the RuleFix GitHub App.

  Personal data

  Repository contents and metadata for the repositories you grant access to; installation and account identifiers.

  Location

  United States

2.Planned sub-processors

We expect to start using these providers soon. They receive no data today; this list gives you advance notice. We will update this page, and notify customers who have asked to be told, at least 30 days before any of them starts processing Customer Data.

• Resend (Plus Five Five, Inc.)Planned — not yet in use

  Purpose

  Transactional email (invitations, security notices, receipts) and, only with your consent, product-update email.

  Personal data

  Name, email address and the content of the email.

  Location

  United States

• Razorpay Software Private LimitedPlanned — not yet in use

  Purpose

  Payment processing, subscriptions and invoicing for paid plans.

  Personal data

  Billing name, email, phone, billing address, GSTIN, transaction details. Card and bank details are collected by Razorpay directly; RuleFix never sees full card numbers.

  Location

  India

3.Services that are not our sub-processors

• GitHub and GitLab sign-in: if you choose to sign in with them, they act as independent providers under their own terms and tell us who you are.
• Public repository hosts (GitHub, GitLab, Bitbucket): when you scan a public repository by URL, we read public files from them without sending them any personal data.
• Your AI agent or IDE (for example Claude, Cursor or VS Code): you choose and configure these; they send code to RuleFix on your behalf and are governed by your agreement with their providers.

4.Updates and objections

To be notified of changes, or to object to a new sub-processor on reasonable data-protection grounds, email privacy@rulefix.in. The objection process is described in section 6 of the DPA.