Legal
Subprocessors
Last updated:
PostureIQ is operated by Gold Tree Group LLC. We use the third-party providers below to deliver the service. We will give customers at least 30 days' notice before adding or replacing a subprocessor.
Infrastructure and hosting#
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All customer and vendor data: accounts, assessments, vendor records, questionnaire responses, uploaded documents | United States (AWS us-east-1) |
| Railway | API hosting | API traffic and application logs, which may contain vendor names, scan targets and email addresses | United States (us-west) |
| Vercel | Web application hosting | Request logs, including visitor IP addresses | Primary processing in the United States; may process elsewhere |
| DigitalOcean | Attack surface scanning | Scan targets, being customer and vendor domains and IP addresses, and scan results | United States (San Francisco) |
Service providers#
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Anthropic | AI analysis of documents, report generation and assessment assistance | Vendor records and contact emails, questionnaire responses, uploaded document text, scan findings. Retained for up to 30 days and not used to train models | Stored in the United States; processing may be routed to other countries |
| Resend | Transactional email | All platform email: vendor invitations, sign-in codes, notifications and alerts, including recipient addresses, vendor names and customer organisation names | United States (us-east-1) |
| Stripe | Subscription billing | Administrator email, organisation name and plan. Card details are entered directly with Stripe and never reach PostureIQ | United States; infrastructure also in India |
| Sentry | Error monitoring, API only | Error reports and a sample of performance data. Request bodies, tokens and local variables are stripped before transmission; error text may contain vendor names or scan targets | United States (Iowa) |
Security data sources#
PostureIQ queries the following sources as part of vendor assessment. These are reference databases we query; they do not store or process data on our behalf.
| Source | Data sent |
|---|---|
| OpenSanctions | Vendor company names and vendor contact names |
| Trade.gov Consolidated Screening List | Vendor company names and vendor contact names |
| Shodan | Vendor domains and resolved IP addresses |
| VirusTotal | Vendor domains |
| AbuseIPDB | Vendor IP addresses |
| crt.sh | Vendor domains |
| URLhaus | Vendor domains |
We also use Have I Been Pwned, the FDA debarment lists, and NVD, CISA KEV and FIRST EPSS. No customer or vendor data is sent to these, as the datasets are retrieved and matched within PostureIQ.
Customer-configured integrations#
Where a customer connects PostureIQ to another system, data flows to that system at the customer's direction. These are not PostureIQ subprocessors.
Microsoft 365, Coupa, Slack, Microsoft Teams, and any email recipients configured in workflow rules.
Website analytics#
| Provider | Purpose | Data |
|---|---|---|
| Google Analytics | Marketing website analytics | Visitor IP addresses, truncated by Google, device and browser information, page URLs and referrers. Marketing pages only; not active within the PostureIQ application |
Changes#
We will notify customer administrators by email at least 30 days before adding or replacing a subprocessor. If you object on data protection grounds, contact privacy@postureiq.io.
Contact#
Gold Tree Group LLC
2044 Lovell Pl, Santa Clara, CA 95051
privacy@postureiq.io