Subprocessors
Every third-party service that processes Kinetry customer data. This list changes only when the product's integrations change — a new subprocessor is added here before it ships.
Vercel
Trust documentation →Purpose: Application hosting, compute, and cookieless web analytics
Data processed: All application traffic in transit; server logs; aggregate cookieless page-view and visitor analytics (no cookies, no cross-site tracking, no personal identifiers)
Location: United States
Certification: SOC 2 Type II (per Vercel's trust center)
Purpose: PostgreSQL database
Data processed: All customer data at rest (workspaces, people, assessments, scores)
Location: United States (AWS us-east-1)
Certification: SOC 2 Type II (per Neon's trust documentation)
Stripe
Trust documentation →Purpose: Payments and subscription billing
Data processed: Billing contact, subscription state, cancellation feedback. Card numbers never touch Kinetry
Location: United States
Certification: PCI DSS Level 1 service provider (per Stripe's documentation)
Resend
Trust documentation →Purpose: Transactional email delivery
Data processed: Recipient names, email addresses, and message content (sign-in links, invitations, results notices)
Location: United States
Certification: SOC 2 Type II (per Resend's security page)
Sentry
Trust documentation →Purpose: Error monitoring
Data processed: Error reports, configured without session replay or personal-data capture; residuals age out within 90 days
Location: United States
Certification: SOC 2 Type II (per Sentry's trust center)
Cloudflare (Turnstile)
Trust documentation →Purpose: Bot detection on signup
Data processed: Browser and network signals during the signup challenge only
Location: Global edge network
Certification: SOC 2 Type II (per Cloudflare's trust hub)
Anthropic
Trust documentation →Purpose: AI narrative generation (coaching summaries, recommendations, 1:1 prep answers)
Data processed: Prompt payloads only: names, computed scores and trends, and advisor and rater notes. Anthropic retains API inputs and outputs for up to 30 days for trust-and-safety purposes, then deletes them, and does not use them to train Anthropic's models (per Anthropic's commercial API terms). Kinetry stores no prompt or output text — only a text-free usage counter
Location: United States
Certification: SOC 2 Type II (per Anthropic's Trust Center)
Change notification
Customers are notified automatically before any new subprocessor starts handling customer data — it's on by default, and a workspace admin can manage it in Admin → workspace settings. Not a customer yet and want a heads-up? Ask us here.
List current as of July 29, 2026. Related: Security & data protection · Privacy Policy