Subprocessors
Last updated: August 27, 2026
A subprocessor is a third-party service we engage that may process data in the course of running Civalyze. This page is the authoritative list. It is referenced by Section 4 of our Privacy Policy, which describes how we handle your information more broadly.
We do not use advertising SDKs, tracking pixels, or cross-site tracking. We do not sell your data, and we do not share it with advertising networks or data brokers.
Current subprocessors
| Subprocessor | Service | Data shared | Purpose |
|---|---|---|---|
| Anthropic | Claude API | Schema metadata (table and column names), your natural-language questions, generated SQL, and a small sample of result rows for context. | AI-powered SQL generation and chat |
| Neon | PostgreSQL hosting | All application data. | Primary database hosting |
| Stripe | Payments | Email address and name. | Payment processing and subscription billing |
| Twilio SendGrid | Email delivery | Recipient email address and email content. | Transactional email delivery |
| Sheets API | OAuth tokens (encrypted at rest), and the contents of sheets you explicitly connect. | Google Sheets data-source integration | |
| Sentry | Error monitoring | Sanitized error diagnostics. No request bodies, no session replay, and no PII fields. | Application error monitoring |
| Cloudflare | CDN and network | Request metadata, including IP address, user agent, and requested URL. | Content delivery, DNS, TLS termination, and denial-of-service protection. All traffic to civalyze.io passes through Cloudflare's network. |
| Cloudflare | Web Analytics | Page path, referring URL, country, device type, browser, operating system, navigation type, and page-load performance timings. No account identifiers, and no content from your data or queries. | Aggregate website traffic and performance measurement |
| Cloudflare | Turnstile | IP address and browser signals collected by the challenge widget on the sign-in, sign-up, and password-reset pages. | Distinguishing human visitors from automated abuse of authentication endpoints |
What is not a subprocessor
Data sources you connect yourself — your own PostgreSQL, MySQL, Supabase, or Neon database, or a Google Sheet you link — are your systems, not our subprocessors. We read from them at your direction over a read-only connection. We do not engage them, we do not control them, and connecting one does not place it on this list.
Stored connection credentials are encrypted with AES-256-GCM and are never shared with any third party, including the subprocessors above.
What we send to our AI provider
Because it is the question we are asked most often: we send schema metadata, your question, the generated SQL, and a small sample of result rows so the model can describe what it returned. We do not send full tables, and we do not send your stored credentials. Privacy Policy Section 3 documents the exact limits and what our AI provider does with the request.
Questions
For questions about this list, or to request our current data-processing documentation, contact us at [email protected].