xray — Subprocessors

Last-Updated: 2026-08-02

xray operates on infrastructure and services provided by the third parties listed below. Information necessary for their function passes through them. Each provider processes data under its own privacy terms; we select providers whose terms are consistent with our Privacy Policy.

Google Cloud — Vertex AI and Gemini

Large-language-model inference. Receives query text and intermediate model reasoning.

Google Cloud Storage

Blob storage for generated report artifacts (rendered PDF exports of your sessions). Receives the finished report content, retained under our own lifecycle (see Privacy Policy §5).

Anthropic

Large-language-model inference. Receives query text and intermediate model reasoning.

Serper

Web search infrastructure. Receives search terms derived from your queries.

WorkOS AuthKit

Authentication and identity. Receives email address, name, and sign-in-provider identifier.

hCaptcha

Bot-detection challenge on the onboarding gate. Receives standard request metadata (IP address, user-agent, interaction signals) needed to score the challenge response.

Google OAuth and GitHub OAuth

Sign-in providers, whichever you choose at sign-in. Receives your email address and profile identifier.

Stripe

Payment processing. Receives credit-card details and billing information.

Fly.io

Application hosting. Receives encrypted network traffic and operational logs.

Cloudflare

DNS resolution and edge protection. Receives standard request metadata.

Changes to this list

We may update this list from time to time as we add, remove, or replace providers. Changes that add a materially different category of processing (for example, a new class of data recipient) are handled through the material-change procedure of our Terms of Service. Vendor swaps within an existing category are reflected here without notice; the "Last-Updated" line above records the most recent revision.