Subprocessors
Last updated: 5 November 2026 · Version française
This English version is provided for convenience. The French version is the legally binding one.
Okkly uses the following providers to run the service. Any change to this list is announced to researchers by email at least 30 days in advance, and they can object by deleting their account.
| Provider | Role | Location | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication, image storage | European Union (Stockholm, Sweden) | Data hosted in the EU, Supabase DPA |
| Vercel Inc. | Application hosting | European Union (Stockholm, Sweden), US company | Vercel DPA, standard contractual clauses, Data Privacy Framework |
| Cloudflare Inc. | Anti-bot protection (Turnstile) | Global network, US company | Cloudflare DPA, standard contractual clauses, Data Privacy Framework |
| Anthropic PBC | AI analysis of answers (at the researcher's request) | United States | Anthropic DPA, standard contractual clauses; API data is not used to train models |
| Brevo (Sendinblue SAS) | Sign-in emails to researchers | European Union (France) | Data hosted in the EU, Brevo DPA |
Transfers outside the European Union
AI analysis is performed by Anthropic in the United States, only when the researcher starts it. Before sending, emails and phone numbers detected in answers are masked, and no direct identifier is sent (testers don't provide any). The transfer is governed by the European Commission's standard contractual clauses.