Trust & Compliance
TurboPentest Subprocessors
Last updated: 2026-05-02
A subprocessoris a third party engaged by TurboPentest to process customer personal data on our behalf - typically a hosting, analytics, payment, or AI inference provider. The list below names every subprocessor we use, what data each one touches, where it's hosted, and a direct link to their data processing agreement (DPA).
This page satisfies our notification obligation under GDPR Article 28(2) and equivalent obligations in CCPA/CPRA, UK GDPR, and the Swiss FADP. We notify customers of changes to this list at least 14 days in advance via email to administrators on file.
For the full processor relationship - including controller/processor roles, security measures, breach notification, and international transfer mechanisms - see our public Data Processing Agreement (DPA). The procurement legal library publishes DPA and Mutual NDA at /legal; additional contracts are available on request via [email protected].
| Subprocessor | Purpose | Data touched | Region | DPA |
|---|---|---|---|---|
| Anthropic | Commercial Claude API for AI agent reasoning | Pentest finding analysis, methodology generation prompts | United States | anthropic.com/legal/dpa |
| Microsoft Azure | Hosting and storage (AKS, Blob Storage, Container Instances) for the application and pentest tooling | Pentest target metadata, pentest tool output, customer account state | United States (East / West) primarily | microsoft.com/licensing - DPA |
| Neon | Managed PostgreSQL database hosting | Customer accounts, pentest schedules, billing state | United States | neon.tech/legal/dpa |
| Stripe | Payment processing and billing | Customer name, email, billing address, payment method | United States | stripe.com/legal/dpa |
| Mailgun | Transactional email delivery (receipts, reports, notifications) | Customer email, customer name | United States | mailgun.com/dpa |
| HubSpot | CRM, calendar booking, and marketing automation | Lead email, marketing engagement events | United States | legal.hubspot.com/dpa |
| PostHog | Product analytics | Anonymized usage events | United States | posthog.com/dpa |
| RB2B | Anonymous visitor identification (B2B reverse lookup) | Anonymous visitor → company match | United States | rb2b.com/dpa |
| GitHub | Source code analysis (only when a customer connects a GitHub OAuth integration for SAST) | Source code snippets temporarily fetched for static analysis | United States | github.com - Data Protection Agreement |
| Google Tag Manager (GTM) | Tag management for analytics scripts | Standard GA-class events (page view, click, referrer) | United States | cloud.google.com - DPA |
Anthropic
Purpose: Commercial Claude API for AI agent reasoning
Data touched: Pentest finding analysis, methodology generation prompts
Region: United States
Microsoft Azure
Purpose: Hosting and storage (AKS, Blob Storage, Container Instances) for the application and pentest tooling
Data touched: Pentest target metadata, pentest tool output, customer account state
Region: United States (East / West) primarily
Neon
Purpose: Managed PostgreSQL database hosting
Data touched: Customer accounts, pentest schedules, billing state
Region: United States
DPA: neon.tech/legal/dpa
Stripe
Purpose: Payment processing and billing
Data touched: Customer name, email, billing address, payment method
Region: United States
DPA: stripe.com/legal/dpa
Mailgun
Purpose: Transactional email delivery (receipts, reports, notifications)
Data touched: Customer email, customer name
Region: United States
DPA: mailgun.com/dpa
HubSpot
Purpose: CRM, calendar booking, and marketing automation
Data touched: Lead email, marketing engagement events
Region: United States
PostHog
Purpose: Product analytics
Data touched: Anonymized usage events
Region: United States
DPA: posthog.com/dpa
RB2B
Purpose: Anonymous visitor identification (B2B reverse lookup)
Data touched: Anonymous visitor → company match
Region: United States
DPA: rb2b.com/dpa
GitHub
Purpose: Source code analysis (only when a customer connects a GitHub OAuth integration for SAST)
Data touched: Source code snippets temporarily fetched for static analysis
Region: United States
Google Tag Manager (GTM)
Purpose: Tag management for analytics scripts
Data touched: Standard GA-class events (page view, click, referrer)
Region: United States
Subscribe to changes
We notify customers of changes to this subprocessor list at least 14 days in advance via email to administrators on file. To receive notifications at a different address, email [email protected] with the subject line “Subprocessor change notifications” and the email you want subscribed.
Parent company context
TurboPentest is a product of IntegSec - the same offensive security team operates trust.integsec.com for the broader IntegSec security program. The subprocessor list above is specific to TurboPentest as a product; IntegSec's service-side subprocessor list is maintained separately on the IntegSec Trust Center.