Subprocessors and service providers
Updated 3 October 2026. Blank uses the providers below to operate the service. The first table identifies providers used to process customer data on our behalf. The second explains payment, contact correspondence, and optional services with different roles. Raw typed or pasted content and matched values stay on the device; these providers receive only the service data needed for their functions.
Subprocessors
| Provider | Purpose and data handled | Processing location and provider information |
|---|---|---|
| Supabase Pte. Ltd. | Database and authentication: organization records, device identifiers, event and detection metadata, administrator accounts, and configured SSO or SCIM records. | Blank's database project is configured in US East, Northern Virginia (us-east-1). Support and other provider operations may occur elsewhere. DPA and provider subprocessors. |
| Netlify, Inc. | Application hosting and serverless APIs: request metadata, authentication tokens during API requests, event metadata in transit, and operational logs. | Global delivery infrastructure; processing is not limited to the database region. Trust Center and provider subprocessors. |
| Plus Five Five, Inc. (Resend) | Transactional email: recipient addresses, authentication messages, alerts, digests, and evidence summaries when requested or configured. Emails can contain finding metadata and report summaries, but no raw matched content. | United States storage; email delivery also involves the recipient's mail provider. DPA, security and locations, and provider subprocessors. |
These links describe each provider's own processing chain. A provider's full list covers its platform and does not mean Blank uses every feature on that list. Contact us for the applicable contracting details for your organization's review.
Other service providers and optional integrations
| Service | When used and data handled | Role and information |
|---|---|---|
| Stripe | Paid Checkout and the billing portal: billing contact details, payment details supplied directly to Stripe, subscription quantities, and invoice records. Blank receives customer and subscription identifiers and payment status, not full card numbers. | Stripe acts as a processor for some activities and an independent controller for others, including certain financial, fraud, and compliance activities. It is not a recipient of employee detection records. Privacy Center. |
| Apple iCloud Mail | Blank's support and privacy inboxes: sender contact details and correspondence for support, billing, privacy, and security requests. | Mail provider for business correspondence under iCloud terms and Apple's Privacy Policy. Apple processes data internationally; no customer-selected country residency is promised for these inboxes. Keep raw employee data and deployment secrets out of email. |
| Optional administrator sign-in: administrator account identity and authorization data. | Used only when an administrator chooses Google sign-in; Google Privacy Policy. | |
| Your identity provider, email recipients, Slack workspace, webhook destinations, or SIEM | SSO, SCIM, alerts, and exports you configure or request. Data depends on the integration, including roster details or finding metadata. | Customer-selected recipients governed by your configuration and agreements. They are not Blank-appointed subprocessors merely because you connect them. |
| Cal.com | An optional walkthrough booking, opened from the website. Contact and scheduling details are supplied on Cal.com's site. | A separate scheduling service; no employee detection records are sent for booking. Cal.com Privacy Policy. |
Changes and questions
For customers with an executed DPA, additions or replacements of Blank-appointed subprocessors follow its notice and objection procedure. The DPA template provides 30 days' advance written notice and a way to raise data protection concerns. A page update alone does not replace that notice.
Use privacy contact for contracting details, locations, change notices, or a copy of the list applicable to your agreement. Blank does not promise EU-only processing or claim that a provider's certification applies to Blank itself.