Security Document
Sub-processor List
The third-party services that process data on our behalf to deliver Simple Commenter, where they operate, and what they handle.
Ander Digital OÜ — Simple Commenter
Document version: 1.1
Technical update: 21 September 2026
Owner: Aleksander Kaaberma, CEO / Information Security Officer
1. Scope
This inventory distinguishes core service providers, AI processing, customer-selected integrations and website/business services. A provider's role depends on the activity and applicable agreement; inclusion does not mean every provider receives every customer's feedback.
The owner confirmed production application hosting on Vercel, database/backups/file storage on Hetzner in Finland and Redis in Stockholm. AWS storage is not in use. Provider identification does not establish the precise contractual entity, configured safeguards or recovery evidence.
2. Core service providers
| Provider | Purpose and data | Location / qualification |
|---|---|---|
| Hetzner Online GmbH | Self-hosted MongoDB: account and project records, comments, configuration, AI histories and operational records; backup storage | Finland. Backup coverage, frequency, retention and restore evidence require operational verification. |
| Hetzner Online GmbH | S3-compatible object storage: screenshots, uploaded files and attachments | Finland, confirmed by the owner. The local endpoint also identifies Helsinki; retain production bucket-region evidence with supplier records. |
| Vercel Inc. | Application/API hosting, delivery, scheduled jobs and platform logs; request/response data and technical metadata | Global delivery network; function execution locations depend on deployment configuration. Do not infer EU-only processing from EU primary storage. |
| Redis provider (previous inventory: Upstash Inc.) | Cache, rate-limit counters and other operational/session data used by the application | Stockholm confirmed; the provider identity must be reconfirmed. |
| Twilio SendGrid | Authentication and notification email; recipient addresses, email content and delivery metadata | International processing, including the US, subject to provider terms. |
| Stripe | Billing, subscription/customer identifiers and payment metadata | International processing, including US/EU. Payment-card entry is handled through Stripe. |
| Better Stack | Application logs and monitoring; technical events and request metadata, potentially including personal data | Existing inventory: Nuremberg, Germany; 365-day retention. Verify active account configuration. |
3. AI providers and processing
| Provider | Purpose | Data potentially processed | Activation / location |
|---|---|---|---|
| Anthropic | Built-in assistant, developer briefs, rewrites, translations and administrative brief evaluation | Conversation/prompt text, authorized feedback/tool results, project context; for briefs, element/device information, selected screenshots and captured console errors according to settings | Project briefs default on when account AI is allowed; other user-facing features run when invoked. International processing; no EU-only configuration established by this review. |
| TypeSafe AI, Inc. | Location suggestions; local administrative brief evaluation and product-research analysis | Bounded target/candidate page text and element evidence; selected brief context or sanitized analytics/research evidence for administrative tools | Location recovery requires separate administrator enablement and defaults off. Administrative replay/research is local-development-only. Provider policy identifies US hosting. |
An installed OpenAI SDK or a connection to ChatGPT does not establish direct OpenAI API processing by Simple Commenter. The built-in provider calls identified in this review use Anthropic and TypeSafe.
Developer briefs are not exclusively opt-in: they default on at project level. The account AI control takes precedence over project settings and manual regeneration. It blocks built-in AI and AI/MCP access for all account roles. Disabling AI does not erase prior disclosures or stop a request already sent. See the Information Security Policy for controls and limitations.
Anthropic's commercial API does not train on inputs/outputs by default, with opt-in/feedback exceptions. TypeSafe states that inputs are not used for model training. These statements do not establish zero retention. Current contract, retention, DPA and transfer details must be verified for the service accounts in use. Sources: Anthropic training policy, TypeSafe privacy policy.
4. Customer-selected integrations and recipients
| Service | Purpose / data shared when used |
|---|---|
| Slack and Discord | Notifications and permitted feedback actions; comment/reply content, status, author details and links/files according to configuration |
| Trello, Jira, Asana, Linear, ClickUp and monday.com | Task synchronization; selected feedback, replies, status and attachments according to supported features/settings |
| GitHub customer integration | Issue/workflow integration; selected feedback and related context |
| Customer webhooks / email destinations | Customer-selected feedback events and configured payloads; destination and onward processing are customer-specific |
| External AI clients through MCP/CLI | Authorized feedback, project context, files and exports; permitted writes/settings where granted |
| WordPress, Shopify, Webflow and optional Chrome extension | Installation and connected platform workflows; access and data depend on the chosen integration |
| Google sign-in / customer SAML identity provider | Authentication identifiers and assertions where the customer chooses those sign-in methods |
These recipients have their own locations, contracts and retention policies. Authorizations are scoped and revocable; disconnecting does not delete copies already received. The account AI switch revokes AI/MCP/CLI access, but other integrations retain their permissions and may have their own AI functionality. Assess them separately for an AI-restricted deployment.
5. Website, development and business suppliers
| Provider | Purpose / data |
|---|---|
| GitHub | Source control and deployment workflow; source, change history and contributor metadata |
| DataFast | Website/product usage analytics, visitor/browser identifiers, events and attribution; selected analytics can be used by local administrative research tools |
| Google Ads | Marketing/conversion measurement on configured platform pages; browser/request and conversion data |
| Domain registrar / DNS provider | Domain administration and DNS records; business contact and account metadata |
Website/business processing is distinct from hosted project storage. See the Privacy Notice and DataFast policy. Analytics locations, retention, consent configuration and relevant agreements require their own review; EU primary storage is not an assurance about these services.
6. Supplier assurance
Maintain evidence of the current contracting entity, service, region, DPA, transfer mechanism and relevant certification/audit scope. The former blanket certification/DPA claims are not extended to new AI/analytics suppliers without verification. GDPR is a legal framework, not a certification. Ander Digital OÜ is not itself ISO 27001 certified.
Review this inventory at least quarterly and when processing changes. Notify customers of material sub-processor changes as required by their agreements. Contact aleksander@simplecommenter.com for the engagement-specific supplier and processing scope.
7. Data-flow summary
Customer browser / site widget / optional platform plugin or extension
|
| HTTPS
v
Vercel application and API
|--> Hetzner MongoDB (Finland): account/project/feedback records
|--> Hetzner S3-compatible storage (Finland): files/screenshots
|--> Redis (Stockholm): cache/rate limits/operational data
|--> Hetzner backup storage (Finland): coverage/schedule to verify
|--> Better Stack: logs/monitoring
|--> SendGrid: authentication and notification email
|--> Stripe: billing
|
|--> Account AI allowed + feature conditions:
| Anthropic: assistant/briefs/rewrites/translations
| TypeSafe: enabled location recovery
|
|<-> Customer-authorized integrations and AI/MCP clients
Authorized local administration
|--> Anthropic / TypeSafe: selected evaluation/research inputs
(account exclusions enforced; mixed research fails closed)
Platform browser pages
|--> DataFast / Google Ads: usage and marketing measurement
International processing can occur on the email, billing, AI, analytics and integration branches even when the primary database and files are in the EU.
Location reference: Hetzner Object Storage locations and endpoints.