Legal
Subprocessors
Every provider that processes personal data for yof, what it receives and where.
Company number and registered address will be added when registration in England and Wales completes. This page is in English for now. A translation is coming.
Last updated: 8 November 2026
yof is provided by Mondaily Ltd, United Kingdom. Placeholder until the company is registered: Company number: to be added after registration in England and Wales. Registered address: to be added after registration.
The list
These providers process personal data for yof. Where a provider may process data outside the EU, the entry says so. We add a provider here before it receives any data, and the date above changes with every change.
No outside AI company receives your code or your data: Patch's model is run by us.
Public lookups (not subprocessors)
These public services receive no personal data, only the items named:
- OSV (api.osv.dev): Package names and versions from a lockfile, to look up known vulnerabilities.
- ENISA EU Vulnerability Database (euvdservices.enisa.europa.eu): Public CVE ids of packages already found vulnerable, to see whether they are known to be exploited (CRA readiness in the Compliance pack and the EU CRA readiness pack, and the CRA reporting helper).
- npm and PyPI registries: Package names, to check that a package exists and how old it is.
- crt.sh certificate log: The domain you proved is yours, to watch for new certificates.
| Provider | What it does | Data it receives | Where | When |
|---|---|---|---|---|
| Supabase | Database and file storage for yof | Your account, your apps and their proof of ownership, checks, findings, orders, report files and Patch's records | EU: Frankfurt, Germany (AWS eu-central-1) | Always |
| Vercel | Hosting for yof.io, app.yof.io and the API behind them | All data passing through the service while it is served | EU: the API runs in Frankfurt (fra1); public pages are cached on Vercel's global edge network | Always |
| Amazon Web Services | The cloud browser that opens your proven website for a check (AWS Lambda), the machine that runs Patch's AI model, our operations machine (incoming mail, outgoing mail through Amazon SES, our own search) and the nightly database backup (Amazon S3) | The address of your proven site and the public pages the browser loads; repository content Patch sends to its model; the email yof sends and receives; a full encrypted copy of the database in the backup. Cloud-browser error logs are kept 14 days, backups 30 days | EU: Frankfurt, Germany (AWS eu-central-1) | Always for backups; the browser only when a website check runs; the model only when Patch writes a fix no rule covers |
| Infomaniak (Swiss Backup) | A second, encrypted copy of the nightly database backup | An encrypted copy of the whole database. Infomaniak cannot read it without our key | Switzerland | Every night; each copy is kept 35 days |
| Inngest (Inngest Cloud) | Runs background jobs: checks, pull request reviews and Patch's repository runs | Job references such as a check id, an app id, your user id and a repository name. No code and no findings | Inngest's cloud; region set by the provider, may be outside the EU | Always |
| Resend | Backup delivery of yof's email: sign-in, alerts, report delivery and support replies | Your email address, the subject and the message | Resend's cloud; region set by the provider, may be outside the EU | Only when our own mail server on AWS in Frankfurt (Amazon SES) cannot take a message; yof sends through that server first |
| GitHub | Sign in with GitHub, and the yof GitHub App: Guard reviews pull requests, Patch reads a linked repository, opens fix pull requests and issues, and uploads findings to code scanning | Sign-in: your GitHub id and primary verified email. The App: the files of a pull request or the linked repository that yof reads, and the comments, check runs, branches, pull requests and issues yof writes back | GitHub's cloud; region set by the provider, may be outside the EU | Only if you sign in with GitHub or install the yof GitHub App on a repository |
| Google (Sign in with Google) | Optional sign-in with Google | Your name, email address, Google account id and profile picture | Google's cloud; region set by the provider | Only if you sign in with Google |
| Microsoft (Sign in with Microsoft) | Optional sign-in with a Microsoft account (personal, work or school) | Your name, email address and Microsoft account id. Signing in never asks for your mail or calendar | Microsoft's cloud; region set by the provider | Only if you sign in with Microsoft |
| Your browser's push service | Delivers yof's alerts to your browser or phone | The alert, which names the affected site only | Run by your browser's maker; region set by them | Only if you switch on push alerts |
| Stripe | Payment for reports and, at launch, for Patch | Your email address, the order and its amount. Card numbers go straight to Stripe's own form; yof never sees or stores them | Stripe's cloud; region set by the provider | Only when you order. Ordering opens at launch; until then nothing is charged |
Questions or problems? Email support@yof.io.