Subprocessors & Data Infrastructure

1. Introduction

Vistra uses selected third-party service providers (“Subprocessors”) to help deliver, maintain, secure, and improve the Vistra platform.

These providers may process customer information only when necessary to provide specific services.

This document explains:

What subprocessors are
Why Vistra uses them
The categories of information they may process
How Vistra manages third-party service providers

2. What is a subprocessor?

A subprocessor is a third-party company engaged by Vistra that may process customer information while helping provide the Services.

Examples include providers supporting:

Cloud infrastructure
Data storage
Payments
Email delivery
Push notifications
Crash reporting
Artificial intelligence features

Vistra remains responsible for ensuring subprocessors are subject to appropriate contractual and security obligations.

3. Subprocessor management

Before using third-party providers, Vistra considers factors including:

Security practices
Privacy protections
Reliability
Data handling procedures
Service requirements

Subprocessors are only granted access to information necessary for their specific function.

4. Current subprocessors

These are the providers we use today. We do not use any analytics or advertising provider.

4.1 Hosting and file storage

Provider: Amazon Web Services.

Purpose: to host and operate Vistra, store the database and uploaded files, and hold database backups.

Information processed may include account information, uploaded content, reports and technical information.

4.2 Payment processing

Providers: Stripe (United States and Ireland) for web payments. Apple and Google process payments for subscriptions bought in the mobile apps. RevenueCat (United States) keeps track of in-app subscriptions.

Purpose: to process subscription payments and manage in-app subscriptions.

These providers process billing information, transaction details and subscription status. Vistra does not store complete payment card numbers. Tax invoices and payment records are held in their systems.

4.3 Push notifications and crash reporting

Provider: Google Firebase (United States). Apple’s notification service delivers push notifications to iPhones and iPads.

Purpose: to deliver push notifications and, only if you agree in the app, to receive crash and performance reports.

Information processed includes a device notification token, and device and app details and technical error information if you have agreed to diagnostics. It does not include report content or photos.

4.4 Artificial intelligence providers

Providers: Anthropic and OpenAI (United States), used only when someone uses an optional AI feature.

Purpose: to provide AI-assisted features such as suggested descriptions and report wording.

Information processed is the content submitted through the AI feature, which may include inspection notes, prompts and photos. A person reviews all AI output before it is used.

See our AI Usage Policy for more.

4.5 Email delivery

Provider: Microsoft 365 (Microsoft), in Australia and the United States.

Purpose: to send service emails such as account, sharing and billing messages, and marketing emails to people who have opted in.

Information processed includes email addresses and the content of the messages.

4.6 Error monitoring

Provider: Sentry (Functional Software, Inc., United States).

Purpose: to detect and fix errors in the Vistra servers.

Information processed is technical error information, such as the page or API address that failed and the error details, and it may include an IP address. We configure it not to send request bodies, cookies, login credentials, the values held in our code when an error happens, email addresses, or the secret parts of share and email links, and we configure it to avoid sending report content or photos.

5. Data location

Customer information may be processed and stored in locations where Vistra and its service providers operate.

The location of stored data depends on:

Infrastructure configuration
Service provider availability
Applicable agreements

Where required, Vistra applies appropriate safeguards for international data transfers.

6. Customer data protection

Vistra requires subprocessors to maintain appropriate protections regarding customer information. These protections may include:

Confidentiality obligations
Access restrictions
Security controls
Privacy commitments
Contractual requirements

7. Customer responsibilities

Customers are responsible for:

Understanding their own compliance obligations
Configuring user permissions
Selecting appropriate information to upload
Ensuring lawful collection of customer data

Vistra provides tools to help manage information but does not determine customer compliance requirements.

8. Changes to subprocessors

As Vistra grows, we may add or replace subprocessors to:

Improve reliability
Improve security
Add functionality
Support new features

Material changes may be communicated through:

Website updates
Customer notifications
Contractual communication where required

9. Customer objection rights

Where required by applicable agreements or laws, customers may have the right to object to the appointment of certain subprocessors.

Any objection must:

Identify the specific concern
Provide reasonable justification
Be submitted through official communication channels

Vistra may evaluate alternatives where appropriate.

10. Security review

Vistra periodically reviews third-party services considering factors such as:

Security practices
Service reliability
Privacy requirements
Operational necessity

11. Additional security information

For more information about Vistra’s security practices, see:

12. Contact

For questions regarding subprocessors:

Privacy email: privacy@vistra.report
Security email: hello@vistra.report
Operator: Shining Technologies
Website: https://www.vistra.report/