Subprocessors
Last updated 15 October 2026.
Every third party that can receive personal data through VibeMyExpt. If a service is not on this list, it does not get your data.
Rows marked study data can receive data derived from participant responses. The rest handle only account, traffic or payment information.
| Provider | Purpose | Data | Processed in |
|---|---|---|---|
| Amazon Web Services (S3, SES, RDS) study data | Runs the service: the application database (accounts, studies, sessions, trial data, consent and payment records), storage for study files, experiment code, recordings and exports, and transactional email. | Accounts, studies, sessions, trial data, payments, study files, recordings, exports, email addresses | India (ap-south-1) on the standard service |
| MongoDB Atlas study data | Holds a frozen copy of the database from before we moved it to AWS on 15 October 2026. Nothing new is written to it, and it will be deleted by mid-November 2026. | Accounts, studies, sessions, trial data, payments, as of 15 October 2026 | India on the standard service |
| Cloudflare | Delivering the public website and API securely and keeping them available: DNS, TLS termination and DDoS protection. Request metadata is processed in transit on the edge network. | Traffic metadata, IP addresses in transit | Global edge network |
| Google Cloud (Vertex AI) study data | Generating and revising experiment code and analysis scripts from researcher prompts, when the researcher has enabled AI assistance for a study. | Researcher prompts, experiment code, dataset structure and summary statistics only | United States or EU region when a dedicated deployment pins inference |
| Anthropic study data | Generating and revising experiment code and analysis scripts from researcher prompts, when the researcher has enabled AI assistance for a study. | Researcher prompts, experiment code, dataset structure and summary statistics only | United States |
| Google (OAuth sign-in) | Authenticating researchers and participants who choose to sign in with a Google account. | Email address, name, profile picture | United States |
| Google Analytics | Measuring how public marketing pages are used, only after the visitor accepts analytics cookies. Never loaded inside a study. | Page views, IP address, browser | United States |
| Razorpay / RazorpayX | Receiving payments from researchers and paying out participant rewards. | Payer identity, amounts, payout bank or UPI details | India |
Where data is stored
| Files, stimuli, recordings and exports (AWS S3) | India (AWS ap-south-1, Mumbai) |
| Outbound email (AWS SES) | India (AWS ap-south-1, Mumbai) |
| Application servers and in-memory cache (Redis) | India |
| Database (Amazon RDS for PostgreSQL) | India (AWS ap-south-1, Mumbai) |
A note on the AI providers
Google Cloud and Anthropic are marked as receiving study data, which deserves an explanation rather than a footnote. When a researcher uses the analysis assistant, the dataset itself stays in their browser — but a structural description of it is sent to the model, including summary statistics and, for columns with fewer than 25 distinct values, the actual list of those values. Free-text responses are described, never quoted.
Both providers process this in the United States, and both state in their published terms that data submitted through their business APIs is not used to train their models. The full account is in the privacy policy.
Changes to this list
We will update this page before a new subprocessor starts handling personal data. Institutions with a signed data processing agreement can ask to be notified of changes in advance — email [email protected] and we will add you to the list.