The list below covers every external service that handles customer-controlled personal data. Services we use for our own internal operations (analytics, observability, internal documentation) and that never see customer data are not listed.
| Sub-processor | Purpose | Jurisdiction | Transfer mechanism |
|---|---|---|---|
| OVH SAS | Hosting: application servers, MongoDB database and Redis job queue (Gravelines data centre) | France (EU) | Intra-EU, no transfer mechanism required |
| Fly.io, Inc. | Per-pull-request analysis sandbox (Fly Machines / Firecracker microVMs, destroyed after each analysis) | United States company; machines run in the Frankfurt region (Germany) | EU-U.S. Data Privacy Framework (Fly.io is certified); Fly.io Data Processing Agreement |
| Fireworks AI, Inc. | Large language model inference for extraction, clustering and triage of each pull request (open-weight DeepSeek models hosted by Fireworks; nothing is sent to DeepSeek) | United States | Standard Contractual Clauses in the Fireworks Data Processing Addendum; prompts and outputs of open models are not logged or stored; no training on customer data |
| OpenAI Ireland Ltd and OpenAI OpCo, LLC | Large language model inference for the in-depth review, finding validation and reasoning across the whole change (GPT models) | Ireland (contracting entity); processing in the United States | Standard Contractual Clauses in the OpenAI Data Processing Addendum; no training on API data; inputs and outputs may be kept up to 30 days for abuse monitoring |
| Stripe Payments Europe, Ltd. | Payment processing, invoicing, customer billing portal | Ireland (EU) and United States | EU contracting entity for EU customers; Standard Contractual Clauses for any onward US transfer |
| Cloudflare, Inc. | DNS, TLS termination and proxy for app.acuvis.dev and api.acuvis.dev, WAF, CDN, inbound email routing, and R2 object storage for database backups | United States, EU points of presence | Standard Contractual Clauses + Data Processing Addendum |
| Plus Five Five, Inc. (Resend) | Transactional email: invitations and notifications (recipient address, subject and message) | United States | EU-U.S. Data Privacy Framework (Resend is certified); Standard Contractual Clauses in the Resend Data Processing Agreement |
| GitHub, Inc. | OAuth identity and the Acuvis GitHub App: webhooks, and reading pull requests and files from, and writing review comments and checks to, the customer's repositories | United States | Standard Contractual Clauses; GitHub is the customer's own code-hosting provider |
| Google LLC | OAuth identity (Sign in with Google) | United States, with EU presence | Standard Contractual Clauses; only invoked when a user explicitly selects Google sign-in |
What leaves our infrastructure
For each review, the pull request's diff hunks, surrounding code context, title and description, your team's review rules and static-analysis results are sent to Fireworks and OpenAI. Neither trains on it. Fireworks does not log or store it; OpenAI may keep it for up to 30 days for abuse monitoring. The working copy of your code inside the Fly.io microVM is destroyed when the analysis ends. Diff hunks are stored in your review documents in our database at OVH (France) and in database backups on Cloudflare R2.
Services you connect yourself
Review comments and checks are written to your own GitHub repositories, and an organisation admin can send review notifications to the organisation's own Slack workspace through an incoming webhook. That data is then handled under your organisation's own agreements with GitHub and Slack.
Change history
- October 2026: OpenAI added for the in-depth review.
Notice of changes
We will email organisation owners at least 30 days before adding a new sub-processor or replacing an existing one. Subscribe to changes by mailing privacy@acuvis.dev with the subject "sub-processor updates". The list on this page is the authoritative source — if a customer needs a point-in-time copy for their own compliance file, contact us and we will issue a signed snapshot.
Objection right
Under Art. 28(2) GDPR, you may object to a new sub-processor on reasonable grounds. If we cannot accommodate your objection within a reasonable period, you may terminate the affected service with a pro-rated refund of any pre-paid fees.