Subprocessors
Four companies can reach your data. Here they are.
A vendor is on this page when data from a retest can reach it. That is a narrower test than every company we pay, which is why the list is four rows rather than twenty, and it is the only version of this list that is useful to the person reviewing us.
How this page behaves
Notice before a change
A new subprocessor is posted here at least 30 days before it takes effect, not after.
You can object
Reply to any entry in the feed below at privacy@riftx.io and we will take it as an objection rather than a question.
Last changed
3 August 2026, and every change before it is listed rather than summarized.
What is not here
Our own database and evidence store are not third parties. They run on the machine in the first row.
The register
Each row says what the vendor does, where it happens, and the specific thing that reaches them.
Anthropic
Model reasoning
United States
The only model path there is. A run decides what to try next, reads what came back, and argues the verdict, and that reasoning happens here. Its commercial terms exclude training on inputs and outputs.
What reaches them
The target URL, your steps to reproduce including anything you put in them, and the captured traffic and artifacts the run reasons over.
netcup
Hosting
Austria
The server the platform runs on. The application, the account database and the evidence store are all on this one machine, operated by us rather than by netcup.
What reaches them
Everything a retest touches, at rest: the submission, the captured traffic, the evidence bundle and the account record.
Cloudflare
Network and access
Global edge
DNS, the tunnel that fronts the dashboard and evidence downloads, and the access gate on the dashboard. Separately, this marketing site is hosted there along with the database behind its demo form.
What reaches them
Traffic in transit, which includes evidence downloads as they are served. Nothing from a retest rests there.
Resend
Transactional email
United States
Account mail, meaning invitations and password resets. Nothing else is sent through it.
What reaches them
The email address on the account and the contents of that message. No retest content and no evidence.
Changes
Newest first. An entry goes up before the change takes effect, so this is a notice board rather than a history.
3 August 2026
This register was published
Four subprocessors, listed above. Nothing changed about how RiftX runs; what changed is that the list is written down somewhere you can check it and be told when it moves.
13 July 2026
Hosting moved to a dedicated machine
The platform moved off a shared VPS onto a dedicated netcup box, and the database and evidence store moved with it. The previous host is no longer in the path.
Related
What is held, and on what basis
The data document, covering inputs, evidence, retention and how to have something removed, is on Privacy.
What bounds the agent
Execution limits, target validation, tenant separation and evidence sealing are on Trust and security.