Data Processing & Subprocessors
Last updated
On this page
Controller and processor
You are the controller of the data you submit and Webcuris is the processor: the service runs on our infrastructure, under our configuration, and the third parties below are our subprocessors. The service phones no home beyond what is listed here — there is no hidden analytics or telemetry endpoint in the code.
The third parties below are contacted by the service, on your behalf, when a scan runs. Each receives only what is listed against it.
Third parties that process your personal data
These are the ones that matter under data-protection law: each of them receives information about you rather than about a system you asked us to scan. The section after this lists the services a scan reaches out to, which receive nothing about your account at all.
| Service | What it receives | Why |
|---|---|---|
| Akamai (Linode) — Mumbai | Everything the application stores, because the server and its database run there | Hosting. The database file lives on this machine; sensitive fields inside it are sealed separately. |
| Polar | Your name, billing address, country and payment details, entered on their checkout | They are the merchant of record — the legal seller on your transaction — so they charge and remit the tax and issue the invoice. No card details reach this application. |
| Resend | Your email address and the contents of the messages we send you | Delivering transactional email: sign-up, password reset, purchase confirmations, plan changes and scan alerts. |
| Cloudflare Turnstile | Your IP address and browser signals, at sign-up, sign-in, password reset, two-factor verification and the contact form | Deciding whether a submission comes from a person. We receive only pass or fail; nothing about you is stored here as a result. |
| Amazon S3 — encrypted backups | An encrypted copy of the database, written by us | Offsite backup. The file is encrypted before it leaves the server, so the contents are not readable by the storage provider. |
Every one of these was added to this page because the code calls it. If you find a service this application talks to that is not listed here, that is a bug and worth telling us about — the promise at the top of the page is that this list is complete, and a promise like that is only worth anything if it is checked.
Third parties contacted during a scan
Each of these receives only what is listed. None receives your account details, your users, or the contents of your findings.
| Service | What is sent | Why |
|---|---|---|
| OSV.dev (api.osv.dev) | Package names and versions from your manifests and lockfiles | Matching dependencies against known vulnerability advisories |
| FIRST.org EPSS (api.first.org) | CVE identifiers only | Exploit-probability scores used in risk ranking |
| crt.sh | The domain being scanned | Certificate transparency lookup for subdomain discovery |
| Cloudflare DNS (cloudflare-dns.com) | The domain being scanned | DNS-over-HTTPS query to check whether DNSSEC validation is in place |
| npm registry (registry.npmjs.org) | Package names of undeclared imports | Checking whether an imported package exists publicly (hallucinated-dependency detection) |
| PyPI (pypi.org) | Package names of undeclared imports | Same check, for Python |
| GitHub (github.com) | The repository URL you asked to scan | Shallow-cloning a repository for code scanning |
| The website you are scanning | Ordinary HTTP requests, plus the CORS origin probes described in the Acceptable Use Policy | The scan itself |
A disclosure worth understanding: checking whether an undeclared import exists publicly means sending that package name to the npm or PyPI registry. For an internal package name, that discloses the name to the registry operator. The check can be turned off entirely with PHANTOM_DEP_REGISTRY_CHECK=off, in which case undeclared imports are still reported but without an existence verdict.
Destinations you configure
Alert delivery sends findings to a destination you choose. Nothing is sent until you configure one, and what is sent is the alert payload — asset, score, and finding titles and severities. Supported formats are generic webhook, Slack, PagerDuty, Datadog and Splunk. Whichever you point at, that vendor becomes a subprocessor of yours for the contents of those alerts.
The red-team suite is the other case: it sends adversarial probe prompts to a model endpoint you nominate and have proven you control. Those prompts are the inert canary payloads described in the AI Usage Policy, and the responses are stored truncated as evidence.
AI processing
This application does not send your data to any AI model. It analyses AI systems and it can red-team a model endpoint you own, but it does not itself use a model to produce findings, write remediation, or process your data. Every finding is produced by deterministic rules in the source.
That is stated here rather than in marketing copy because it is the kind of claim people reasonably assume is untrue, and because it constrains what future changes may do without updating this page. See the AI Usage Policy.
International transfers
The services above are operated in various jurisdictions, principally the United States. Webcuris contacts them directly when a scan runs, so any transfer is one the service makes on your behalf; assess it against your own obligations. The data involved is limited to what the table lists: package names, CVE identifiers and domain names. No personal data is transmitted to any of them by this software.
Keeping this accurate
This list is accurate for the code it ships with. It will become wrong the first time a scanner gains a new data source and nobody updates this page — so if you are operating a deployment for others, treat “add an outbound request” and “update this page” as the same change.