1. Overview
InvisibleAct uses a limited number of third-party infrastructure and service providers ("Subprocessors") to deliver hosting, database persistence, domain routing, and transactional notifications.
Zero Prompt / Content Invariant: Because InvisibleAct operates under a metadata-only model, these providers process only application hosting containers, database persistence of authorization metadata, and business contact information. No customer prompt text, natural language model conversations, or raw customer data payloads are ever transmitted to or stored with these subprocessors.
2. Identified Subprocessors & Services
The following table lists the third-party providers currently utilized or supported by InvisibleAct:
| Subprocessor / Service | Purpose | Data Involved | Optional / Configuration Dependent? |
|---|---|---|---|
|
Render (Render Services, Inc.) |
Cloud Application Hosting & API Runtime Provides container hosting and compute execution for the FastAPI backend gateway and static dashboard services. |
System container logs, encrypted network traffic, ephemeral application state in memory. |
NO (for hosted SaaS deployments). Self-hosted customers do not utilize Render. |
|
Neon / PostgreSQL (Neon Inc.) |
Managed Relational Database Persistence Provides cloud-hosted, serverless PostgreSQL storage for multi-tenant deployments. |
Authorization metadata, audit logs, tenant policy configurations, agent registry, vendor trust records, and SHA-256 hashed API keys and session tokens. |
YES. Utilized only when DATABASE_URL is configured for PostgreSQL in production/staging. Development and local offline deployments utilize local SQLite storage without external connectivity.
|
|
Cloudflare (Cloudflare, Inc.) |
DNS Routing & Web Security Proxy Provides domain name resolution, SSL/TLS termination, and distributed denial-of-service (DDoS) mitigation. |
Web request routing metadata, client IP addresses, HTTP headers. |
YES. Utilized where external domain routing and DNS management are configured for invisibleact.com and public API endpoints.
|
|
Resend (Resend, Inc.) |
Transactional Email Delivery Dispatches notification emails to InvisibleAct administrators when prospective customers submit a demo or pilot inquiry on the website. |
Inbound lead business contact information (name, email, company, framework, submission timestamp).
|
YES. Strictly configuration-dependent. Dispatches emails only when RESEND_API_KEY is explicitly configured. If unset, no data is sent to Resend. Customer runtime /check operations never interact with Resend.
|
3. Subprocessor Governance & Safeguards
- Data Minimization: Subprocessors receive only the data strictly required to execute their specific infrastructure or notification role.
- Contractual Safeguards: Providers are selected based on industry-standard security practices, confidentiality agreements, and data processing commitments.
- Updates to Subprocessors: If new infrastructure providers or subprocessors are integrated into the InvisibleAct platform, this document will be updated prior to deployment.
- Inquiries: Questions regarding third-party subprocessors may be directed to [email protected].