Subprocessors

Last updated: 2026-05-11.

A subprocessor is a third-party service that Ripenn uses to deliver the Ripenn product, where that service may receive or process customer data on Ripenn's behalf. This page lists every current subprocessor, what each one receives, and where they are based.

For how this data is collected, see Privacy. For how AI providers (a category of subprocessor) handle prompt content specifically, see Data Usage. For Ripenn's production architecture, see Security.

Infrastructure

SubprocessorPurposeData receivedLocation
SupabaseManaged Postgres database and authenticationAll application data: accounts, audit configurations, audit results, project membersAWS us-east-2 (Ohio, US)
VercelWeb app hosting, edge routing, TLS terminationRequest metadata, IP addresses, deployment logsGlobal edge; US-based company
Google Cloud RunContainer runtime for Temporal workersWorkflow payloads at runtime (not stored long-term by the runtime)US region
Temporal CloudWorkflow orchestration for background jobsWorkflow IDs, metadata, payloads passing through in transitUS-based
InfisicalSecrets management for production credentialsEncrypted secrets (Supabase keys, API tokens, OAuth credentials)US-based

AI providers (used for audit runs)

These providers receive the prompts in your prompt set when audits run. See Data Usage for the full breakdown of what each one does with those prompts.

SubprocessorPurposeData receivedLocation
OpenAIEngine call (ChatGPT / GPT-5.2)Prompt textUS
AnthropicEngine call (Claude) and analysis callPrompt text; engine responses for analysisUS
GoogleEngine call (Gemini via Vertex AI)Prompt textUS
PerplexityEngine call (Perplexity)Prompt textUS

Payments

SubprocessorPurposeData receivedLocation
StripePayment processing, subscription managementBilling email, subscription state, payment events. Card numbers handled directly by Stripe; never seen by Ripenn.US

Observability and analytics

SubprocessorPurposeData receivedLocation
PostHogProduct analyticsStable user ID, email, profile name, page views, feature flag evaluationsUS Cloud

Anti-abuse

SubprocessorPurposeData receivedLocation
Cloudflare TurnstileAnti-bot challenge on the sign-in formChallenge token, request metadataGlobal edge; US-based

Optional integrations

These subprocessors only receive data if you connect or invoke them.

SubprocessorPurposeData receivedLocation
Jina ReaderUsed to render JavaScript-heavy pages during content importsThe URL being crawledSingapore-based; global edge
WebflowContent publishing (if you connect your Webflow account)OAuth token and the content you explicitly pushUS
WordPress.comContent publishing (if you connect your WordPress account)OAuth token and the content you explicitly pushUS

International data transfers

Most of Ripenn's subprocessors are based in the United States. For customers in the EU, UK, or EEA, transfers of personal data to the US and other non-EEA jurisdictions are covered by Standard Contractual Clauses with each subprocessor, supplemented by the UK International Data Transfer Addendum for UK customers. Where a subprocessor offers additional certifications (Data Privacy Framework, ISO 27001, SOC 2), Ripenn relies on those as further safeguards.

Changes to this list

When Ripenn adds, removes, or replaces a subprocessor that handles customer personal data, this page is updated and the change is recorded in the public Ripenn repository. Material additions (a new category of provider, or a provider that processes a new category of data) are communicated to active customers by email at least 14 days before the change takes effect, giving you the opportunity to object.

To subscribe to subprocessor change notifications, email support@ripenn.ai with the subject “Subscribe: subprocessor updates”.

Questions

For DPA requests, vendor security questionnaires, or specific questions about any subprocessor on this list, email support@ripenn.ai.