Who else touches your data
Last updated: August 2, 2026 · Every third party in the system is on this page. If it isn't listed, it doesn't receive anything.
How to read this
A subprocessor is any outside service that handles data on our behalf. Two things are worth knowing before the list. First, the contents of your email never leave our system, because we never read them: Tombstone requests header metadata only, uses each header to work out who sent the message, and discards it. Second, the two AI providers receive different things, and neither may train on any of it. Anthropic receives only a company name and its domain, and only when we are hunting for that company's published privacy contact. Groq receives that same company name and domain, plus, for the features that need them, the first and last dates that company emailed you and the public descriptors of any breach that company appeared in. All of it is derived from your Gmail metadata, so we treat all of it as Google user data. Neither provider ever receives your email address, your subject lines, or your account list. The per-provider table below states exactly what each one gets.
Processing your data
| Provider | What it does | What it receives |
|---|---|---|
| Google (Ireland / LLC) | Sign-in and the source of your Gmail metadata. | Your Google account identity, and the header metadata we are authorized to read. Google is where your data already lives; we read from it, we send nothing new to it. |
| LeakCheck | Breach lookup on the home page and in the app. | One email address, submitted with your explicit consent. Nothing else. |
| Have I Been Pwned | Breach severity and context for the results. | Breach names looked up as public reference data. Your email address is not sent to this service. |
| Groq (Llama 3.3 70B, hosted by Groq) | Sorting companies into categories, ranking your exposure, drafting letter text, writing deletion walkthroughs. | A company name and its domain, public breach descriptors, and the dates a company emailed you. Groq does not train on API inputs or outputs, and the account runs with Zero Data Retention enabled. |
| Anthropic (Claude Haiku, with web search) | Last resort only: finding a company's published privacy contact when our directory and site scrape both miss. | A company name and its domain, which identify a company found in your mailbox. Never your email address, headers, subjects, or account list. Anthropic does not train on API inputs or outputs. Skipped entirely when unconfigured. |
| Render | Runs the web app and the background worker. | Everything the app processes, as the environment it executes in. |
| Supabase | Hosts the Postgres database. | Your stored account list, scan history, and your Google token, which is encrypted before it is written and is never stored in plain text. |
| Cloudflare | DNS, TLS termination, and CDN in front of the app. | Request metadata in transit: IP address, user agent, and the URL requested. |
| Google Analytics | Page and funnel analytics on the live site only. | Anonymized IP address, page paths, and referrer. Never your email address or anything from your mailbox. See the cookie policy. |
What we require of them
- No training on your data. We will not use an AI provider or tier that trains on what we send it. This is a hard requirement, not a preference. Data derived from Google Workspace APIs is never used, transferred, or sold to create, train, or improve any generalized or foundational AI model.
- Zero data retention from the AI provider handling classification and drafting.
- No aggregators or gateways. We call each provider's own API directly. Nothing is routed through a model hub, a proxy, or a router that could send it somewhere we have not named on this page.
- No selling, no advertising, no data brokering. None of these providers receives data from us for any of those purposes.
- Encryption in transit on every connection, and encryption of the Google token at rest before it reaches the database.
Changes
This page is the current list. If we add a provider that handles your data, it appears here, and the date at the top changes. To be told when that happens, or to ask anything about a provider above, write to support@tombstonepro.com.