HeimdlLegal
Subprocessors
Service providers
We use a small number of service providers to run Heimdl. They process data only on our instructions, under written terms that protect it.
| Provider | What for | Data it receives | Location |
|---|---|---|---|
| GitHub (Microsoft) | Sign in, repository access, posting results on pull requests | GitHub identity, repository content, pull request data, results we post back | United States |
| Google Cloud Platform (Cloud Run, Compute Engine, Firestore, Cloud Storage, Secret Manager, Cloud Logging) | Website, API, running checks, database, caches, logs | All service data | United States: us-west1 (API, database, caches), us-west4 (check machines, caches), us-east4 (website) |
| Firebase Authentication (Google) | Sign in | The identity GitHub or Google shares at sign in | Google, a global service |
| Google Workspace (Google) | Email: hello@ and security@heimdl.ai | Emails you send us, including privacy, deletion and security requests | Google, a global service |
| OpenRouter and the model providers it routes to (Inception, TypeSafe, Google Vertex AI or Amazon Bedrock) | Review models: choosing what to change, test generation, severity, impact and which gaps to test (zero data retention, never used for training) | Changed lines and the code around them, file paths and locations, test results, pull request comments addressed to Heimdl | United States, and the provider's zero data retention endpoint chosen by OpenRouter |
| Anthropic | Repository setup at onboarding (kept up to 30 days, not used for training) | The repository being set up | United States |
This is the complete list of service providers that receive customer data.
Payments
Polar (Polar Software, Inc.) is our merchant of record. It processes your payment and billing details as an independent controller under its own privacy policy, not on our behalf. It receives billing details, never your code.
Changes
We will update this list before a new service provider starts receiving customer code. Questions: hello@heimdl.ai.