TRUST · SUB-PROCESSORS

The providers that help us run Conectir.

A sub-processor is a third-party company we rely on to operate Conectir, and which may process customer data on our behalf. We keep this list current and post material changes here before they take effect.

Supabase

Database, authentication and file storage

Case records, statements, uploaded evidence files and account details. Access is restricted per user with row-level security.

Vercel

Hosting and content delivery for the website and app

App traffic and standard request metadata (e.g. IP address, browser) needed to serve and secure the site.

Anthropic

AI reasoning — SCAN, timeline reconciliation, the Case Council, the AI Advisor and financial narrative

Statement text and case context, sent only at the moment of analysis and never used to train AI models.

Google (Gemini)

AI reading of documents and audio — scanned or photographed statements, bank statements and voice recordings

Images, PDFs and voice recordings, sent only at the moment of processing. On Conectir's paid Google API tier, this content is not used to train Google's models.

Google Cloud (Vision API)

Reverse image search — finding where else a case photo appears on the public web

The single image you choose to search, sent only at the moment of the search under the Google Cloud Data Processing Addendum. Google does not store the image after processing and does not use it to train its models. No face recognition is performed and no faceprint is ever created — the tool compares images, not faces. It returns public pages showing the same image, and other public images that resemble it, for the investigator to review; the tool identifies no one.

Sightengine

AI-image detection — a confidence score that a case image was AI-generated or face-manipulated

The single image you choose to check, sent only at the moment of the check. The detector analyses pixel content only; the image is not used to train Sightengine's models. The result is an indicator score, never a verdict.

ipinfo.io

IP address enrichment — the owner/ISP, coarse location and VPN/proxy flags for an IP address in a case

The single IP address you choose to look up, sent only at the moment of the lookup. No case context or personal details accompany it.

Internet Archive

Page-history lookup — finding earlier archived versions of a public web page (the Wayback Machine)

The single web-page address you choose to look up, sent only at the moment of the lookup so the archive can return its dated snapshots. No case context or personal details accompany it, and the target is never notified.

Abstract (AbstractAPI)

Phone and email enrichment — whether a phone number is valid, its line type (mobile, landline or VoIP) and carrier of record; and whether an email address is valid and deliverable, disposable, a role address, free webmail or a catch-all domain, and whether the address has appeared in known public data breaches

The single phone number or email address you choose to check, sent only at the moment of the check. No case context or personal details accompany it. These are status, validity and reputation checks, not identity lookups — they do not return the name of the person behind the number or address.

Resend

Email delivery for account and team emails

The recipient's email address and the message content for the essential emails Conectir sends — sign-in and magic links, account confirmation, password resets, team invitations, and a report you choose to email to your own client. Never marketing email.

ImprovMX

Inbound email forwarding for conectir.com addresses

Incoming emails sent to conectir.com addresses (for example hello@conectir.com), forwarded on to our team inbox. ImprovMX handles inbound forwarding only — it does not send Conectir's outgoing email.

Account emails — sign-in and magic links, account confirmation and password resets — and the emails Conectir sends from the app — team invitations and any report you choose to email to your own client — are all delivered through Resend (above). Incoming mail to conectir.com addresses is forwarded by ImprovMX. Conectir's notifications are shown in-app and are never sent by email.

QUESTIONS

A Data Processing Agreement (DPA) covering these sub-processors is available to customers on request. For questions about how your data is handled, get in touch.