A subprocessor is any third-party service we rely on to deliver Citerank that processes customer data or audit data on our behalf. This page lists every subprocessor we currently use, what each one does, and what data it receives. It is referenced from our Privacy Policy and is the source Enterprise and agency customers should check when completing a vendor security review or requesting a DPA.
We will update this page whenever we add or remove a subprocessor. Customers who have requested a formal Data Processing Agreement will be notified by email at least 14 days before a new subprocessor with access to personal data goes live, per Section 3 of our Privacy Policy.
| Subprocessor | Purpose | Data received |
|---|---|---|
| Vercel | Application hosting, serverless compute, scheduled jobs | All request/response data in transit; no data at rest beyond logs |
| Supabase | Database, authentication, file storage | Account data, scan history, saved audits, session tokens |
| Resend | Transactional email delivery (audit results, digests, alerts) | Email address, name, and the content of the specific email being sent |
| Subprocessor | Purpose | Data received |
|---|---|---|
| LemonSqueezy | Subscription billing and payment processing for direct purchases | Email, billing details, payment card data (we never receive or store card data ourselves) |
| AppSumo | Lifetime-deal purchase processing and license issuance | License key and plan tier; AppSumo does not share your payment card details with us |
These providers receive only the URL or domain you submit, plus text content fetched from that page during analysis (title, meta description, on-page content). We never send your account email, payment data, or stored API keys to any AI provider. Full detail is in Section 3 of our Privacy Policy.
| Subprocessor | Purpose | Data received |
|---|---|---|
| Google (Gemini) | AI Overview tracking, citation scoring, structured analysis, Knowledge Graph and PageSpeed lookups | URL/domain and fetched page content |
| OpenAI | Citation detection and content analysis | URL/domain and fetched page content |
| Anthropic (Claude) | Structured reasoning, entity analysis, content scoring | URL/domain and fetched page content |
| Perplexity AI | Perplexity citation tracking | URL/domain and fetched page content |
| xAI (Grok) | AI engine breakdown analysis | URL/domain and fetched page content |
| Microsoft (Bing Search API) | Web citation verification | URL/domain and search query text |
| DataForSEO | SERP data, keyword metrics, AI Overview detection | Domain, keyword, and SERP query data |
| Browserless | Headless browser rendering for JavaScript-heavy pages | The target URL and rendered page content |
| Subprocessor | Purpose | Data received |
|---|---|---|
| Google Analytics | Aggregate site traffic measurement | Pages viewed, referral source, general usage patterns (see our Cookie Policy) |
| Microsoft Clarity | Session recordings and heatmaps to improve product UX | On-page interactions (clicks, scroll, mouse movement); never password field contents |
If you need a signed DPA, a security questionnaire completed, or more detail on any subprocessor above, use our contact form.
© 2026 Citerank · Privacy Policy · Terms of Service · Refund Policy · Cookie Policy · Subprocessors