Trust center · Subprocessors
Who processes your data, and what they get.
Use this list to answer the subprocessor questions in a vendor review. Each row says what the provider does for Skylos, which customer data it receives, where it runs and when it is involved. Rows marked “to be confirmed” are facts we have not verified yet, not guesses.
A Data Processing Agreement is available on request. We use the Common Paper DPA v1.1 standard terms (CC BY 4.0), with the subprocessor list on this site as its list of approved subprocessors.
Last checked against the code: 15 October 2026
- Request the DPA
Opens your email app with a DPA request addressed to the Skylos maintainer.
- Download security overview
Saves a Markdown file with this list, the data flows and questionnaire answers.
- Back to the Trust center
Opens the trust overview: data flows, controls and what Skylos does not claim.
Subprocessors
Providers Skylos uses to run Skylos Cloud. Customers who sign the DPA get notice of changes to this list as its terms require.
Vercel
Hosting for the web app, API and scheduled jobs; runtime error logs
Customer data
Everything sent to or shown by Skylos Cloud passes through it: account details, uploaded scan reports (findings, file paths, code snippets, commit author emails) and the tokens in API requests
Location
United States: functions run in Vercel's pdx1 region (Portland, Oregon); static pages are served from Vercel's global edge network
When
Always
Vercel Sandbox (Vercel)
Temporary, isolated virtual machines for hosted scans: Cloud scans of connected repositories, the public /scan page and deep scans
Customer data
A full copy of the scanned repository at one commit, for the length of one scan. Each sandbox is created non-persistent and stopped when the scan ends
Location
United States: Vercel's default Sandbox region, iad1 (Washington, D.C.). Skylos's code sets no other region; to be confirmed against the project's settings
When
Only for hosted scans you start or turn on
Supabase
Postgres database, sign-in (Auth) and file storage
Customer data
Everything Skylos Cloud stores: accounts (GitHub user ID, name, email, avatar), workspaces and roles, scan reports and findings, audit logs, encrypted integration credentials and hashed API keys; report files while an upload is in progress
Location
United States: AWS us-west-2 (Oregon)
When
Always
GitHub
Sign-in, the Skylos GitHub App and tokenless CI uploads (GitHub Actions OIDC)
Customer data
Sign-in reads only your public profile and email addresses. Through the App, Skylos reads repository metadata and single files on demand, and writes the pull request comments, check runs and pull requests you ask for, which contain findings or code changes
Location
GitHub's own hosting (to be confirmed per your GitHub plan)
When
Sign-in always; the App only on repositories where you install it
Lemon Squeezy
Merchant of record: checkout, payments, invoices and sales tax
Customer data
Your email address and a checkout reference from Skylos. Card and billing details you enter on Lemon Squeezy's checkout never reach Skylos
Location
To be confirmed
When
Only when you buy a plan or credits
OpenAI
AI triage and Fix in PR, on Skylos's own OpenAI API key
Customer data
AI triage: the rule, title, file paths, one code snippet and taint-flow locations of an issue. Fix in PR: the whole source file (up to 64 KiB) and the finding
Location
To be confirmed
When
Only when a signed-in member requests AI triage, or an owner or admin clicks Fix in PR
Anthropic
Deep scans (VulnHunter), on your workspace's own Anthropic API key
Customer data
Source code from the scanned commit, as the model reads it. This runs under your Anthropic account and terms, and Anthropic bills you for it. When the key is saved, Skylos checks it once by listing one model, which sends no code
Location
Set by your Anthropic account
When
Only after an owner or admin saves a key and someone starts a deep scan
Resend
Transactional email: invitations, workspace deletion notices, weekly digest and reminders
Customer data
Recipient email address, workspace and project names and, in the weekly digest, the rule IDs, file paths and line numbers of new issues
Location
To be confirmed
When
Only when email is turned on. It is not turned on yet; Resend is listed in advance
Cloudflare
DNS for skylos.dev and forwarding of email sent to founder@skylos.dev
Customer data
Email you send to founder@skylos.dev. Website and API traffic does not pass through Cloudflare
Location
To be confirmed
When
DNS always; email only when you write to us
Google (Gmail)
The maintainer's mailbox, which receives forwarded founder@skylos.dev email
Customer data
Support, privacy, DPA and security email you send to founder@skylos.dev
Location
To be confirmed
When
Only when you write to us
Services you connect yourself
These are not Skylos's providers. Data goes to them only when a workspace connects them, and only to the address or site the workspace chooses. Owners and admins can disconnect them in project or workspace settings at any time, and deleting a workspace removes their stored credentials and webhook addresses before any other data.
Slack and Discord
Gate results and exception reminders, sent to the incoming-webhook URL a workspace saves
Outbound webhooks
Signed event payloads sent to the HTTPS address a workspace sets
Jira Cloud
Tickets a member creates from a Skylos issue, in the Jira site an owner or admin connects
GitLab.com
Review discussions on changed lines of merge requests, for connected GitLab projects
Bitbucket Cloud and Azure DevOps
Pull request comments, statuses and annotations for connected repositories
Not used
- No third-party error tracking (such as Sentry), session replay, product-analytics SDK, advertising network or data broker. Application errors go to Vercel's runtime logs.
- Vercel Web Analytics counts page views on public marketing pages only, with the address stripped to its path (no query string). Dashboard pages are not tracked.
Other outbound lookups
- GitHub's OIDC signing keys (token.actions.githubusercontent.com), to verify tokenless CI uploads. Nothing is sent.
- PyPI (pypi.org): the package name a repository declares, checked before Skylos opens a weekly cleanup pull request.
- OSV (api.osv.dev): during a Cloud scan, the package names, ecosystems and versions the repository's manifests and lockfiles declare, to look up known vulnerabilities. No code or file contents.
The open-source CLI makes its own requests (OSV, package registries, the model provider you configure). They are described on the Trust center and do not pass through Skylos.