Subprocessors

Last Updated: May 19, 2026

This page lists the third-party subprocessors that Hacksplaining uses to provide our security awareness training platform. Each subprocessor is bound by appropriate data protection obligations.

Email Notifications

To receive notifications when we add or change subprocessors, email support@hacksplaining.com with the subject "Subscribe to Subprocessor Updates."

Current Subprocessors

Amazon Web Services

  • Location: United States
  • Purpose: File storage (AWS S3) for progress reports and licensed content
  • Data Processed: Training progress reports, email addresses, completion data

Cloudflare, Inc.

  • Location: United States (global network)
  • Purpose: Application hosting, content delivery network (CDN), DDoS protection, logging, analytics
  • Data Processed: IP addresses, location, HTTP requests

Functional Software, Inc. (Sentry)

  • Location: United States
  • Purpose: Error tracking, debugging, and application monitoring
  • Data Processed: Error logs, stack traces, user context, IP addresses

Google LLC (reCAPTCHA)

  • Location: United States
  • Purpose: Bot detection and spam prevention
  • Data Processed: IP addresses, browser fingerprints, user interaction patterns

MyEmailVerifier (Email Verifier Inc.)

  • Location: United States
  • Purpose: Pre-send email address validation during signup and login to reduce bounces and protect sender deliverability
  • Data Processed: Email addresses submitted during account creation and login. Raw addresses are purged immediately upon validation; cryptographic hashes are retained for up to 30 days.

PostHog, Inc.

  • Location: United States
  • Purpose: Product analytics and user behavior tracking
  • Data Processed: Usage data, feature interactions, user session data

Resend, Inc.

  • Location: United States
  • Purpose: Transactional email delivery
  • Data Processed: Email addresses, names, email content (signup magic links, login codes, invitations, password resets, notifications)

Stripe, Inc.

  • Location: United States
  • Purpose: Payment processing
  • Data Processed: Payment information, billing details

Supabase (Supabase Inc.)

  • Location: Singapore / United States
  • Purpose: Application database, authentication infrastructure, file storage for progress report and license content
  • Data Processed: User accounts, OAuth provider data, training data, user progress, organizational information

Vercel Inc.

  • Location: United States
  • Purpose: Application hosting, analytics, content delivery, logging
  • Data Processed: Application data, usage logs, IP address

Subprocessor Changes

We will notify subscribers at least 10 business days before:

  • Engaging any new subprocessor
  • Replacing an existing subprocessor

If you object to a new subprocessor, you may contact us within 30 days at support@hacksplaining.com. If we cannot resolve your concerns, you may terminate your subscription without penalty.

Data Protection Requirements

All subprocessors are required to:

  • Implement security measures at least as protective as those described in our Data Processing Agreement
  • Comply with applicable data protection laws
  • Process data only as instructed by Hacksplaining
  • Assist with data subject requests and security incidents

For questions about our subprocessors, contact support@hacksplaining.com.