The processors that help run Index8.
Version 2026-06-16. Last updated June 16, 2026. Questions: privacy@index8.app.
How to read this list
Index8 uses a small set of third-party processors to operate the service. Each one receives only the data its function requires. This page lists every processor, what it does, and the data it handles. It supports our Privacy Policy and Data Processing Addendum. Entries marked “When configured” are active only once the related integration is enabled.
Current subprocessors
| Subprocessor | What it does | Data it handles |
|---|---|---|
| Supabase | Authentication, database, and evidence file storage | Account details, workspace content, uploaded evidence files |
| Vercel | Application hosting and content delivery | Request metadata and server logs |
| Stripe | Payments and checkout | Billing contact and payment status. Card details are entered on Stripe-hosted pages and never reach Index8 servers. |
| ResendWhen configured | Transactional and lifecycle email delivery | Recipient email address and message contents |
| SentryWhen configured | Error monitoring | Error events, scrubbed of personal data before they are sent |
| PostHogWhen configured | Product analytics | Cookieless event identifiers, plan names, and computed score bands. No names, emails, or free-text answers. |
| UpstashWhen configured | Rate limiting and abuse prevention | Hashed identifiers and request counters |
Index8 is operated from the United States. Card details are handled entirely by Stripe and never reach Index8 servers.
Connected accounts you enable
If you connect a workspace integration such as Google Workspace or Microsoft 365, that provider acts as a source you authorize, not a subprocessor we route your data through. Index8 requests read-only access limited to directory and security-posture information, never email content, files, calendars, or messages. Connection tokens are stored encrypted and deleted when you disconnect.
Changes to this list
When we add or remove a subprocessor, we update the version and date above and post the change here. If you have an active workspace and would like advance notice of subprocessor changes, email privacy@index8.app and we will add you to the notice list.
This page is a draft prepared for legal review and is informational. It is not a contract on its own; processing terms are set out in the Data Processing Addendum.