Legal
Sub-processors
A sub-processor is a third party that Dino engages to process customer data while providing the service. Dino remains responsible to you for each sub-processor under our Data Processing Agreement.
Current sub-processors
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Cloudflare, Inc. | Core platform: Workers compute, D1 database, R2 object storage, KV, Vectorize, and networking | All primary customer data, stored region-partitioned |
| Google Cloud (Google LLC) | Managed and pool runner compute (Cloud Run) for scan execution, deployed in the workspace region | Scan execution context, decrypted credentials in memory at scan time, and scan results |
| Stytch, Inc. | Authentication, Single Sign-On, SCIM provisioning, and multi-factor authentication | User identity data: email, name, organization membership, and authentication events |
| Polar Software, Inc. | Subscription billing and payments | Billing contact and subscription data. No scan data. |
| Anthropic, PBC | LLM inference for AI agents and reasoning | Prompt and completion content, with secrets redacted. No credentials. |
| OpenAI, L.L.C. | LLM inference, where used | Prompt and completion content, with secrets redacted. No credentials. |
| Cloudflare Workers AI | LLM inference on the Cloudflare platform, where used | Prompt and completion content, with secrets redacted |
| PostHog, Inc. | Product and operational analytics | Tenant-anonymous events. No tenant identifier, no credential, and no target data. |
| Factors.ai | Website visitor identification: reveals the company (not the individual) associated with a marketing-site visit, for sales follow-up | Website visitor IP address and page activity, resolved to company-level firmographics. No customer product data. |
Bring your own key
When you use bring-your-own-key for AI features, AI requests are processed by the model provider under your own account and terms, not as a Dino sub-processor.
Changes
We provide notice before adding or replacing a sub-processor that processes customer personal data, by updating this page and notifying account administrators. You may object to a new sub-processor on reasonable data-protection grounds as set out in our Data Processing Agreement.
To receive notifications of changes, contact privacy@usedino.dev.
Change log
| Date | Change |
|---|---|
| June 19, 2026 | Initial published list. |
| June 24, 2026 | Added Factors.ai (website visitor identification). |
For general questions, visit our Contact page.