Trust
Subprocessors
Last updated: October 18, 2026
BugMojo uses a small set of vetted third-party providers to operate the service. Each processes data only under contract and only for the purpose listed below. This page lists the subprocessors that may handle customer data. See our Privacy Policy for how data is shared and retained.
Core infrastructure
These providers are part of the standard data path for every workspace that uses the product, except Microsoft Clarity, which runs only on our public marketing pages.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Vercel | Hosts the BugMojo web app and API and runs scheduled jobs. Every request to bugmojo.com passes through it. | United States (app servers); global edge network |
| Neon | Managed PostgreSQL database: accounts, workspaces, projects, issues, comments, and capture metadata. | Singapore |
| Amazon Web Services (AWS S3) | Object storage for capture artifacts: session replays, console and network logs, screenshots, and any video or voice notes. | United States |
| Zoho Mail | Primary transactional email over SMTP (sign-in, invitations, and notification email). | India |
| Resend | Backup transactional email, used only when the primary mail provider is unavailable. | United States |
| Upstash | Rate limiting. Holds short-lived request counters keyed by IP address, email address, or link token to block abuse. | Global (replicated across regions) |
| Sentry | Application error monitoring and diagnostics to keep the service reliable. | United States |
| Microsoft Clarity | Aggregate website analytics on our public marketing pages, with text and form inputs masked by default. | United States |
Feature-specific providers
These providers handle data only when the feature they support is turned on.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Cloudflare Turnstile | Bot check on public feedback boards and widget submissions, when turned on. Sees the visitor’s browser and IP address, not capture content. | Global (Cloudflare network) |
AI providers (optional, BYOK)
BugMojo agents run on your own model keys (bring-your-own-key). Data is sent to one of the providers below only when your workspace configures an agent with that provider’s API key, and only to the provider you select. Workspaces that don’t use AI agents share no data with these providers.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Anthropic (Claude) | AI agent inference when a workspace configures an agent with its own Anthropic API key. | United States |
| OpenAI | AI agent inference when a workspace configures an agent with its own OpenAI API key. | United States |
| Google (Gemini) | AI agent inference when a workspace configures an agent with its own Google API key. | United States |
Changes
We may update this list as our infrastructure evolves. Material changes are reflected by the “last updated” date above.
Not in use yet: a payment processor (Stripe) for self-serve billing, a container host for hosted test runs, and a device cloud (BrowserStack or LambdaTest) for hosted mobile test runs. Each will be added to this list before it handles customer data. Questions? Email contact@bugmojo.com.