Shellvoide Trust Center
Security is what we do, and how we operate. Explore our compliance posture, security controls, policies, and platform architecture.
Each subprocessor is bound by contract to protect your data. We provide advance notice of material changes.
| Category | Vendor | Purpose | Data accessed | Region |
|---|---|---|---|---|
| Cloud Hosting | AWS & Contabo | Hosting the KLUE platform and infrastructure. | Customer account and scan content. | Germany |
| Database & Object Storage | Supabase | Managed database and blob storage with per-tenant row-level security. | Customer account and scan content. | Germany |
| AI Model Providers | Frontier & Open Source Models | LLM processing for KLUE's reasoning engine. | Redacted context under restrictive terms. | Global |
| Source Control | GitHub | Cloning code from connected repositories. | Repository metadata and source code for the duration of a scan. | United States |
| Payment Processing | Paddle.com | Checkout and subscription billing. | Billing contact. Card details never stored. | Global |
| Transactional Email | Resend | Verification, password reset, and account emails. | Email address and message content. | United States |
| Application & Website Hosting | AWS, Contabo & GitHub Pages | Serving the application frontend and public website. | Application logs and hosting metadata. | Germany & United States |
| Website Analytics | Google Analytics | Anonymized usage analytics, consent only. | Aggregated, anonymized data. | Global |
| E-Signature | Docuseal | Signing contracts and policy documents. | Signer identity and document metadata. | United States |
International transfers & your DPA
Shellvoide is based in the United States. Where we transfer personal data out of the EEA or UK, we rely on Standard Contractual Clauses or an applicable adequacy decision. A DPA is available on request.