Trust

Sub-processors

The third-party services we rely on to deliver Outerank. We notify customers in writing 30 days before adding a new sub-processor.

Sub-processor	Purpose	Data processed	Location	DPA
Anthropic	Claude API — generates audit fixes, articles, outreach drafts, AI advisor responses	Prompts you submit (e.g. an audit issue or article keyword). Not retained for training.	United States · EU customer prompts processed in EU	View DPA →
Cloudflare, Inc.	DNS, CDN, DDoS protection, Turnstile bot-shield, Email Routing	Request metadata (IP, user-agent, URL), bot-check tokens, mailbox aliases	Global edge — EU PoPs serve EU traffic	View DPA →
Resend, Inc.	Transactional email delivery (verification, password reset, notifications)	Recipient email, subject, message body, delivery status	United States	View DPA →
Hetzner Online GmbH	Server hosting + Postgres database storage (production)	All customer data at rest (encrypted), backups	Germany · Finland (EU)	View DPA →
Stripe, Inc.	Payment processing (subscriptions, invoices) — when payments are live	Card details, billing address, country, last-4. Never shared back to us.	United States · Ireland (EU)	View DPA →
Google LLC	OAuth 'Sign in with Google' — verifies identity at signup/login	Email, name, profile picture URL when user explicitly authenticates	United States	View DPA →

Notification policy

We email all customers 30 days in advance before adding any new sub-processor. You can object during that window — if we can't resolve the concern, you can terminate your subscription with a full pro-rated refund.

To subscribe to sub-processor change notifications even if you're not yet a customer, email security@outerank.com.

Last updated: 16 May 2026.