Subprocessors
Last updated 28 August 2026
Every third party that processes data on our behalf, what each one handles, and where it processes it. Published rather than available on request, because a list you have to ask for is not much of a list.
The short version
Nine providers, all listed
Infrastructure, AI, and email. Each processes data only to perform its function, under its own data protection terms.
No trackers inside the product
No product analytics and no error-monitoring provider. What happens in your workspace is answered from our own records.
30 days' notice before any addition
New subprocessors are posted here and emailed to account administrators before they begin processing, so you have time to object.
The summary is for orientation only; the numbered sections below are the full, binding text.
1.Who processes your data
AxonQA uses the providers below to deliver the service. Each processes data only to perform its function and under its own data protection terms. We do not sell customer data.
| Provider | What it does | Data it processes | Region |
|---|---|---|---|
| Supabase | Primary application database | All customer content stored by the application | European Union (Ireland) |
| Vercel | Application hosting, serverless functions, CDN | Request data and application traffic | European Union (Dublin); CDN edge is global |
| Cloudflare R2 | Object storage for screenshots and run artifacts | Screenshots and test-run artifacts | Western Europe. Placement, not a contractual residency guarantee |
| Google Cloud Run | Cloud runners for test execution and application exploration | Test scripts, run metadata, temporary execution artifacts | European Union and United States |
| Anthropic | AI: test generation, healing, application understanding | Prompt text and application context, with secrets and identifiers redacted from text. Screenshots where used, unredacted | United States |
| OpenAI | AI: vision extraction, embeddings, generation, fallback | Prompt text and application context, redacted as above. Documents and screenshots where used | United States |
| Resend | Transactional email: verification, invitations, notifications | Email address, name, message content | United States |
| Plausible Analytics | Traffic measurement on our public website and sign-in pages only. Not used inside the product | Page views and named conversion events. No cookies, no device storage, no personal data | European Union |
| Stripe | Payment processing, subscriptions, billing portal | Billing contact details and subscription metadata. Card details go directly to Stripe and are never stored by AxonQA | Not yet enabled. Billing is not live |
2.Used only if you enable it
BrowserStack. Optional cloud browser and device execution, used only if you connect your own BrowserStack account. It processes test scripts and browser session data for the run, under your own account and its terms, and you contract with them directly.
The local agent works the other way: install it and tests run from inside your own network, so execution data stays on your infrastructure and reaches no cloud execution provider at all.
3.What we deliberately do not use
No product analytics inside the application, and no error-monitoring provider. What happens in your workspace is answered from our own records rather than a third-party tracker.
Our only measurement is Plausible on the public website and sign-in pages. It is cookieless and stores no personal data, which is why this site never asks you to accept cookies. If we ever add a provider that does set cookies, this page changes and a consent banner becomes mandatory before it may load.
4.Where your data is processed
Our database, our application, and your stored artifacts are all in Europe. Test execution can run in either our EU or our US region, and our AI and email providers are US-based.
We do not claim EU-only data residency, because it would not be true. Every transfer out of the UK and EU is covered by Standard Contractual Clauses and the UK Addendum with the provider concerned. Our data processing agreements with both AI providers were executed on 16 August 2026 and incorporate both.
A fuller breakdown, item by item with retention and AI exposure, is on our data handling page.
5.How we change this list
We will post any new subprocessor on this page and email account administrators at least 30 days before it begins processing, so you have time to object. That window is deliberately identical to the one committed in our Data Processing Addendum; if one changes, both change.
Questions about subprocessors, or a request for our DPA: privacy@axonqa.com.
Ready to see AxonQA on your own app?
Create a project and generate your first test cases in minutes.