Veridence | Sub-Processors

Agiphi Inc. ("Veridence") uses the third-party service providers listed below in the delivery of our forensic codebase due diligence service, including our Slack integration. We contractually require all sub-processors to implement appropriate technical and organizational measures to protect personal data and comply with applicable data protection laws including GDPR.

If you have questions about this list or wish to submit a data deletion request, contact us at contact@agiphi.com.

Infrastructure & Hosting

Company	Service	Purpose	Data Location
Oracle Corporation oracle.com/cloud	INFRASTRUCTURE	Application hosting, encrypted PostgreSQL database storage, and compute for audit execution. Slack workspace tokens and audit metadata are stored encrypted on OCI.	United States

Third-Party APIs

Company	Service	Purpose	Data Location
GitHub, Inc. (Microsoft) github.com	API	Repository content retrieval for forensic AST audit execution. Source code is fetched on-demand into ephemeral RAM sandboxes and immediately destroyed post-execution. No code is retained.	United States
Slack Technologies LLC slack.com	API	Delivery of audit reports, slash command processing, and Bot Token storage for workspace integration. Slack workspace IDs and OAuth tokens are stored encrypted.	United States

Billing & Invoicing

Company	Service	Purpose	Data Location
Relay Financial (Thread Bank) relayfi.com	PAYMENTS	Enterprise invoice generation and wire transfer processing for paid subscription plans. No Slack workspace data is shared with payment processors.
Stripe, Inc. stripe.com	United States	Card payment processing for commercial subscriptions. Cardholder data is processed exclusively on Stripe's PCI-DSS Level 1 certified infrastructure. Veridence does not store card numbers. Stripe receives: billing email, company name, and plan tier only.	United States

Zero-Retention Architecture: Veridence is built on a zero-retention principle. Target repository source code processed during audit commands is executed entirely within volatile, ephemeral RAM sandboxes. No customer source code, AST graphs, or intellectual property is written to disk or transmitted to any sub-processor. Only audit metadata (repository URL, compliance status, timestamp) and Slack workspace tokens are persisted, in encrypted storage on Oracle Cloud Infrastructure.

Updates to this list: We will update this page at least 30 days before adding a new sub-processor that processes personal data. Customers with data processing concerns may email contact@agiphi.com to object to a new sub-processor.