Sub-processors

What this list is

Cavioo runs on our own servers in Spain, but it relies on other companies’ services. When one of them handles personal data from your account or your audits for us, it is a sub-processor. This page names each one. Our Privacy policy explains what we collect and why.

Business customers who need a data processing agreement can ask us for one at [email protected].

Running Cavioo

• Neon (our database): your account, your projects, the audits you ask for, your reports and findings, and billing records. Location: London, United Kingdom, on Amazon Web Services. The European Commission recognises the United Kingdom as protecting personal data to the same standard as the European Union.
• Cloudflare (network, file storage and email): every visit to cavioo.com passes through Cloudflare’s network, which sees your IP address. Cloudflare also stores your audits’ screenshots, the records of audits you stop, the emails websites send to the robot’s test accounts and our backups, and sends our service emails. Stored files: Western Europe, the location we chose; Cloudflare aims to keep them there but does not guarantee it. Network and email: Cloudflare’s data centres around the world, in more than 100 countries (a visit usually goes through one near the visitor); Cloudflare is based in the United States.
• Clerk (sign-in): your name, email address, profile picture and how you sign in, and the IP address and browser you sign in from. Location: the United States. Clerk keeps all its data there and offers no other region.

AI analysis

To run your audits and write their reports, Cavioo sends the journey you described, screenshots and page text to AI models, and gets their answers back. If your journey includes a password for the site, it goes to the AI models too, so the robot can sign in. Sign-in details you give us are masked before anything is recorded.

• OpenRouter: passes each request to a company that runs the chosen model, and passes the answer back. Location: the United States, and possibly other countries outside the European Economic Area.
• xAI: runs the Grok models, which we use directly. Location: the United States, and other countries where xAI operates.

In the 30 days to 6 October 2026, the models came from OpenAI, Google, Z.ai, Moonshot AI, DeepSeek and Xiaomi. The companies recorded as running them for OpenRouter were OpenAI, BaseTen, CoreWeave, Crusoe, DeepInfra, Fireworks, Inceptron, InferenceNet, Makora, Modal, Morph, Near AI, NextBit, Parasail, Phala, Reka, Together and Wafer. Which one runs a request can change from one request to the next. Where each one is based, as OpenRouter lists them on 13 October 2026: the United States for OpenAI, BaseTen, CoreWeave, Crusoe, DeepInfra, Fireworks, InferenceNet, Modal, Morph, Parasail, Phala, Together and Wafer; Sweden for Inceptron, which runs in Finland; and Spain for NextBit. OpenRouter gives no location for Makora, Near AI or Reka.

Real-visitor speed

• Google (Chrome UX Report, Google’s figures on how fast pages load for people using Chrome): once per audit, Cavioo sends it the addresses of the audited pages, without anything after a “?” in them, to fetch how fast those pages load for real visitors. Location: Google’s servers around the world; Google is based in the United States.

Payments

• Stripe (payments): when you go to pay for a plan or credits, your name, email address, billing address, tax or VAT number, card details and what you buy. Card details go straight to Stripe; we never see your full card number. Location: the United States, India, the European Union and other countries where Stripe operates.

Fonts and icons

• Google: our pages load their fonts and icons from Google’s servers, so your browser connects to Google, which sees your IP address. Your browser does this directly, not through us. Location: Google’s servers around the world; Google is based in the United States.

Services you connect yourself

If you connect Jira and export findings to it, they go to your own Jira account, under your own agreement with Atlassian.

Changes to this list

When we add or replace a sub-processor, we update this page and the date at the top.