Subprocessors and data flow

Summary#

Metric Vault is built on a small set of outside services. This page names them, states exactly what each one receives, and — more usefully for a vendor review — states what they do not receive. The short version: the search-data and AI providers get the domain, keyword or content you submitted and nothing about who submitted it; Stripe gets your billing relationship and never gives us your card number; and no provider receives your reports or your account credentials.

The formally published sub-processor list is on the GDPR & Data page at metricvaultai.com/legal/gdpr. This page is the operational version of it, mapped to the features that trigger each transfer.

Overview#

Every processor is bound by a data processing agreement requiring it to process personal data only on our instructions, apply appropriate security measures, and assist us with our own obligations. None is authorised to use your data for its own purposes.

Three principles decide what leaves the platform, and they are worth reading before the tables.

Providers receive the query, not the querier. When you run a tool, the domain or keyword goes to the data provider. Your email address does not. There is nothing in a provider request that identifies which account made it.

Nothing is sent to train a model. We do not use your data to train third-party AI models, and we do not permit our providers to.

Card data never transits our systems. Payment details are entered on Stripe's pages and are never processed by, stored on, or passed through Metric Vault.

The published sub-processor list#

These are the processors named on the GDPR & Data page.

Every service that touches data, and what it receives#

This is the fuller operational map, including the services that sit inside the "hosting and infrastructure" line above and the providers behind individual features.

Several of these are optional and never activate unless you use the feature. Search Console, the social channels, the blog studio and its image tools all require an explicit connection or action from you. See Integrations for what each integration does and Disconnecting an integration for removing one.

What leaves the platform when you run a tool#

Worth tracing once, because it is the question every vendor review asks.

1. You submit a domain, URL, keyword or brand in the dashboard.
2. The server checks your plan, your credits and, for any URL you supplied, that the target is a public internet address rather than a private or internal one.
3. The query is sent to the relevant provider — DataForSEO for search data, Google for page speed, an AI provider for analysis or writing. Your account identity is not part of that request.
4. The provider's answer comes back, is analyzed and scored, and the finished result is stored against your account.
5. If the tool is one of the cached ones, the provider's answer is also kept in a shared cache keyed by the tool and the query, so the next lookup of the same thing does not re-bill the provider. That cache carries no account identifier. See Result caching and freshness.

Nothing in that path sends your reports, your saved work, your team, your billing details or your credentials anywhere.

What never goes to a third party#

Notes for a vendor review#

• Transfers. All of the above are US-based or international. For EEA, UK and Swiss customers those transfers are covered by Standard Contractual Clauses or the UK IDTA. Copies are available on request. See GDPR and compliance.
• Changes. If we onboard a new sub-processor that materially affects your data, the GDPR page and this article are updated, and we notify you where required.
• A complete named list. The published list above names the processors we formally disclose. If your assessment needs every vendor named, including the hosting and identity providers, write to hello@metricvaultai.com and we will provide the current list rather than leaving you to infer it.
• Documents. Ask the same address for a data processing agreement, the applicable SCCs or IDTA, or a completed security questionnaire.
• Provider behavior. Where the data comes from explains what each data source actually measures and how fresh it is, and AI models used across the platform maps each feature to the model behind it. Those two are the right pages when the question is about data quality rather than data protection.