Trust center · subprocessors

Who handles CrawlCheck’s data, and where it is.

Every outside service that receives anything from CrawlCheck or from your browser on this site, what it receives, and where each kind of data is stored. Checked against the running system on 2026-10-07. crawlcheck.io is owned by VSNARY.

outside services that receive data

ENAM

where evidence is stored: Eastern North America

copy outside Cloudflare, the sealed-day mirror

request logs kept by Cloudflare for us

Services

Outside services that receive data

Service	What for	What it receives	Where
Cloudflare	Runs and stores everything: the Workers that serve the site and measure, KV, R2 object storage, Durable Objects, Analytics Engine, Vectorize, DNS, outbound email, the open-weights models in the benchmark and the headless browser	Everything the site stores or serves	Code runs at the Cloudflare location nearest each request; R2 evidence storage in Eastern North America; KV replicated across Cloudflare's network
GitHub	An off-account copy of each sealed day, the weekly rebuild test, the transparency-log witness, the independent observer runs and our deploy workflows	Each sealed day (domains, what each crawler received, digests) in a private repository; signed log heads; observers' readings of public pages. Nothing from an account	GitHub.com (United States); workflows on GitHub-hosted runners
Stripe	Checkout and billing	What you enter on Stripe's own checkout page; we never see a card number	Stripe's systems
Google Workspace	Our mailbox, hello@crawlcheck.io	Mail you send us	Google's data centres
Google APIs	PageSpeed and Chrome UX field data; Search Console and Business Profile when you connect them; Gemini for answer checks and the benchmark; YouTube data for the YouTube module; place lookups; public DNS as a fallback resolver	A public URL, domain, business name or test prompt; your Google data only after you grant access	Google's data centres
Google Fonts	Two typefaces on every page	Your browser fetches the font files from Google, so Google sees that browser's address and user agent	Google's data centres
OpenTimestamps calendars	Anchoring the daily seal to Bitcoin	One hash per day; no report content	Public calendar servers; the Bitcoin blockchain
OpenStreetMap Nominatim and Photon	Turning a service-area city into coordinates	A city name	Their public servers
Wikidata, the Internet Archive and RDAP	An entity's identifiers, a page's history, when a lookalike domain was registered	A public name, URL or domain	Their public servers

Download only

Public data we only download

Nothing about you or a scan is sent.

Source	Used for	What it receives
A public ranking of the most-visited sites	the census frame	nothing beyond the download request
AI and search operators' published address ranges	verifying that a crawler is who it claims to be	nothing beyond the download request
A public what-is-my-address service	recording the Worker's own outbound address	nothing beyond the request
Search engines, through IndexNow	announcing crawlcheck.io's own new pages	crawlcheck.io page addresses only

Residency

Where each kind of data is stored

Store	What it holds	Where	Access
Workers (compute)	The code that serves every page and runs every scan	The Cloudflare location nearest each request	Nothing is stored here between requests
KV	Records, measurement rows, signed answers, the logs below	Replicated across Cloudflare's network; no region is pinned	Not public; read only through the site
R2: evidence	The bytes each crawler received, signed manifests, archived records and answers, receipts, dispute, deletion and removal records	Eastern North America	Not public: no custom domain, public URL off
R2: daily backups	A copy of every stored key (values, metadata, expiry) under a signed manifest; private key material is never copied	Eastern North America	Not public; the last 7 days
Encrypted off-account backup	The same daily backup, encrypted before it leaves	GitHub (workflow storage), 30 days	Unreadable without the key held outside the repository
R2: research corpus	Pages our own research crawler read	Eastern North America	Not public: no custom domain, public URL off
Durable Objects	Usage counters and quota reservations	Placed by Cloudflare near first use	Counts only
Analytics Engine	Page-speed readings sent by visitors' browsers	Cloudflare's network	Site, page path, metric, country and connection type; no address
Sealed-day mirror	A copy of each sealed day	GitHub.com (United States), private repository	The only copy kept outside Cloudflare, on purpose

Logs

What is logged, where, and for how long

How long everything else is kept: retention.

Log	Where	Kept	Note
Owner and admin actions	KV	90 days	Credentials are masked before the line is written
Errors	KV	The last 200, at most 14 days	Credentials are masked
Recent requests to this site	KV	The last 200	Includes the requesting address; owner only, never published or exported
Security reports received	KV	400 days	Credentials are masked
Access to a private report	KV	The last 500 entries, for as long as the report exists	Who by kind and a masked identifier, the masked address; never a key, cookie or query string. Deleted with the report
Outbound email	KV	The last send for 7 days, the last error for 1 day	Time, subject and the address masked to its first letter and domain
Cloudflare request logs	Off	Not kept	Workers Logs off, no Logpush, no tail Workers, on both Workers

Changes

Changes to this list

A new service is listed here before it receives data. Machine-readable: /subprocessors.json.

Date	Change
2026-10-07	This page and its JSON published. The list was already on /trust; added here: YouTube data, place lookups and public DNS under Google APIs, the observer runs under GitHub, and the services we only download from.

Trust center · What we collect · Removal requests · Holds