Sub-processors
Last updated: 25 October 2026.
TL;DR — These are all the companies that touch personal data on our behalf, what each one receives, and why. Nothing else sees your data.
| Sub-processor | Purpose | Personal data they receive |
|---|---|---|
| Have I Been Pwned (Superlative Enterprises Pty Ltd, AU) | Breach lookups | The email addresses you asked us to monitor — as lookup queries, after you verify them |
| Resend (Resend, Inc., US — EU processing region) | Transactional and notification email (verification, alerts, digests) | Your email address and the message content |
| ImprovMX (US) | Forwarding mail sent to our published addresses (support@, security@, …) | Only the messages you send us at those addresses |
| Laravel Cloud (Laravel LLC, US) on AWS (eu-central-1, Frankfurt) | Hosting — application, database, cache, object storage | All platform data, encrypted at rest, kept in the EU |
| Sentry (Functional Software, Inc., US) | Error monitoring for the app and the API | Technical error reports: stack traces, request path and browser details; never account contents or passwords |
| Slack / Telegram (optional) | Notification channels you connect yourself | The notification messages you opted into |
What "receives" means
Each sub-processor receives only what its function requires, under a data-processing agreement. None of them may use your data for their own purposes. The full internal record — every table we hold, retention clocks, and what survives account deletion (spoiler: almost nothing) — is summarised in our privacy policy and what we store.
Questions
privacy@secbird.io — a human reads it.