Current provider categories
The configured subprocessors are Neon for the PostgreSQL database and customer identity, Cloudflare for application runtime, edge, queue, storage and isolated execution, Mollie for payments, subscriptions and invoices, Resend for transactional email, GitHub for optional read only repository connections and social sign in, Mistral for bounded redacted explanations, Alibaba Cloud Model Studio Qwen for bounded Ask AI requests, Sentry for redacted technical error and trace data when enabled, and PostHog EU Cloud for consent based coarse page analytics and separately gated content free AI operational metrics. Microsoft Clarity is shown separately on this provider overview because Microsoft acts as an independent controller for its consent based public page analytics, not as a Vybentis subprocessor.
Private GitLab account connection
The GitLab OAuth connection is currently restricted to Core Industry. It stores the connected account ID, username and encrypted access and refresh tokens. The granted read_api scope can read API data for projects accessible to that account, although Vybentis currently uses it only to confirm account identity. GitLab repository scans and customer connections are disabled. GitLab's data protection role and transfer terms need review before any customer integration.
Before production
Hosting regions, contractual terms, transfer mechanisms and the final subprocessor list require operator verification before any production launch.
Provider roles
Neon receives account identity, session, organization and product data for authentication and database services. Cloudflare receives bounded application request, queue, storage and scanner execution data. Mollie receives payment, subscription, invoice and required tax data only for an initiated billing action. Resend receives recipient and transactional message data. GitHub processes the optional repository connection and social sign in. Mistral receives only minimized and redacted finding fields for an explicitly requested explanation or fix prompt. The configured Alibaba Cloud Model Studio Qwen endpoint receives only a bounded question and minimized deterministic finding metadata for Ask AI. Sentry receives redacted technical errors and traces only when enabled after provider review. PostHog EU Cloud receives consent based anonymous page route categories. If its separate server integration is reviewed and enabled, it receives only fixed operation names, model, bounded latency, token counts, HTTP status, fixed outcome and opaque scan and trace identifiers. It receives no AI prompts, outputs, raw errors, URLs, evidence, source or actor identifiers. Separately, Microsoft Clarity may receive the masked page structure, public page and referrer data, interactions, device and diagnostic data, identifiers, IP address and approximate location described in the privacy and cookie notices. Microsoft acts as an independent controller for Clarity under its privacy terms.
Change process
Material subprocessor changes are assessed for purpose, data scope, location, security and transfer safeguards. Customers entitled to contractual notice receive it through the agreed channel before the change takes effect where required by the applicable data processing agreement.