{"kind":"crawlcheck-subprocessors","v":1,"updated":"2026-10-07","operator":"VSNARY","services":[{"name":"Cloudflare","purpose":"Runs and stores everything: the Workers that serve the site and measure, KV, R2 object storage, Durable Objects, Analytics Engine, Vectorize, DNS, outbound email, the open-weights models in the benchmark and the headless browser","receives":"Everything the site stores or serves","where":"Code runs at the Cloudflare location nearest each request; R2 evidence storage in Eastern North America; KV replicated across Cloudflare's network"},{"name":"GitHub","purpose":"An off-account copy of each sealed day, the weekly rebuild test, the transparency-log witness, the independent observer runs and our deploy workflows","receives":"Each sealed day (domains, what each crawler received, digests) in a private repository; signed log heads; observers' readings of public pages. Nothing from an account","where":"GitHub.com (United States); workflows on GitHub-hosted runners"},{"name":"Stripe","purpose":"Checkout and billing","receives":"What you enter on Stripe's own checkout page; we never see a card number","where":"Stripe's systems"},{"name":"Google Workspace","purpose":"Our mailbox, hello@crawlcheck.io","receives":"Mail you send us","where":"Google's data centres"},{"name":"Google APIs","purpose":"PageSpeed and Chrome UX field data; Search Console and Business Profile when you connect them; Gemini for answer checks and the benchmark; YouTube data for the YouTube module; place lookups; public DNS as a fallback resolver","receives":"A public URL, domain, business name or test prompt; your Google data only after you grant access","where":"Google's data centres"},{"name":"Google Fonts","purpose":"Two typefaces on every page","receives":"Your browser fetches the font files from Google, so Google sees that browser's address and user agent","where":"Google's data centres"},{"name":"OpenTimestamps calendars","purpose":"Anchoring the daily seal to Bitcoin","receives":"One hash per day; no report content","where":"Public calendar servers; the Bitcoin blockchain"},{"name":"OpenStreetMap Nominatim and Photon","purpose":"Turning a service-area city into coordinates","receives":"A city name","where":"Their public servers"},{"name":"Wikidata, the Internet Archive and RDAP","purpose":"An entity's identifiers, a page's history, when a lookalike domain was registered","receives":"A public name, URL or domain","where":"Their public servers"}],"download_only":[{"what":"A public ranking of the most-visited sites","for":"the census frame","receives":"nothing beyond the download request"},{"what":"AI and search operators' published address ranges","for":"verifying that a crawler is who it claims to be","receives":"nothing beyond the download request"},{"what":"A public what-is-my-address service","for":"recording the Worker's own outbound address","receives":"nothing beyond the request"},{"what":"Search engines, through IndexNow","for":"announcing crawlcheck.io's own new pages","receives":"crawlcheck.io page addresses only"}],"stores":[{"store":"Workers (compute)","holds":"The code that serves every page and runs every scan","where":"The Cloudflare location nearest each request","note":"Nothing is stored here between requests"},{"store":"KV","holds":"Records, measurement rows, signed answers, the logs below","where":"Replicated across Cloudflare's network; no region is pinned","note":"Not public; read only through the site"},{"store":"R2: evidence","holds":"The bytes each crawler received, signed manifests, archived records and answers, receipts, dispute, deletion and removal records","where":"Eastern North America","note":"Not public: no custom domain, public URL off"},{"store":"R2: daily backups","holds":"A copy of every stored key (values, metadata, expiry) under a signed manifest; private key material is never copied","where":"Eastern North America","note":"Not public; the last 7 days"},{"store":"Encrypted off-account backup","holds":"The same daily backup, encrypted before it leaves","where":"GitHub (workflow storage), 30 days","note":"Unreadable without the key held outside the repository"},{"store":"R2: research corpus","holds":"Pages our own research crawler read","where":"Eastern North America","note":"Not public: no custom domain, public URL off"},{"store":"Durable Objects","holds":"Usage counters and quota reservations","where":"Placed by Cloudflare near first use","note":"Counts only"},{"store":"Analytics Engine","holds":"Page-speed readings sent by visitors' browsers","where":"Cloudflare's network","note":"Site, page path, metric, country and connection type; no address"},{"store":"Sealed-day mirror","holds":"A copy of each sealed day","where":"GitHub.com (United States), private repository","note":"The only copy kept outside Cloudflare, on purpose"}],"logs":[{"log":"Owner and admin actions","where":"KV","kept":"90 days","note":"Credentials are masked before the line is written"},{"log":"Errors","where":"KV","kept":"The last 200, at most 14 days","note":"Credentials are masked"},{"log":"Recent requests to this site","where":"KV","kept":"The last 200","note":"Includes the requesting address; owner only, never published or exported"},{"log":"Security reports received","where":"KV","kept":"400 days","note":"Credentials are masked"},{"log":"Access to a private report","where":"KV","kept":"The last 500 entries, for as long as the report exists","note":"Who by kind and a masked identifier, the masked address; never a key, cookie or query string. Deleted with the report"},{"log":"Outbound email","where":"KV","kept":"The last send for 7 days, the last error for 1 day","note":"Time, subject and the address masked to its first letter and domain"},{"log":"Cloudflare request logs","where":"Off","kept":"Not kept","note":"Workers Logs off, no Logpush, no tail Workers, on both Workers"}],"changes":[{"date":"2026-10-07","change":"This page and its JSON published. The list was already on /trust; added here: YouTube data, place lookups and public DNS under Google APIs, the observer runs under GitHub, and the services we only download from."}],"page":"https://crawlcheck.io/subprocessors","retention":"https://crawlcheck.io/trust#retention"}