What this list is
Subprocessors are companies that process data on behalf of METAQUANTICS so the service can work: hosting, database, email delivery, artificial intelligence and supporting services. In the terms of Brazil's data protection law (LGPD, Law 13.709/2018, art. 5, VII), they act as processors.
The list below was checked against the system's code and configuration on the date shown at the top of the page. Some providers are only used when the matching environment variable is set on the instance; the "When it is used" column says so for each one.
What you search also leaves this instance
Besides the subprocessors, several platform lookups go to public data sources (for example, a domain, IP or email search). Those sources do not process data on our behalf, but they receive the value being looked up. The full list is in the Privacy Policy.
Infrastructure
These providers run the official METAQUANTICS instance. Anyone who hosts their own copy of the software chooses their own infrastructure, and this table does not apply to that copy.
| Provider | Purpose | Data involved | Region | When it is used |
|---|---|---|---|---|
| Vercel | Hosting of the web application, the API routes and the scheduled jobs (Vercel Cron). | Data from every HTTP request: IP address, browser (user agent), page visited and time, plus the functions' technical records (logs). | Global edge network. The functions' region is set in the Vercel project and is not pinned in the repository. | Always, on every visit to the official instance. |
| Supabase | Managed Postgres database. Sign-in is METAQUANTICS's own: Supabase stores the data but does not perform authentication. | Accounts (email, name, password hash, plan and status), admin panel settings, the audit trail, API keys stored only as hashes, alert channel subscriptions, a shared cache of public feeds and the rate limit counter, with the IP pseudonymised by HMAC. | São Paulo, Brazil (sa-east-1). | When the instance has a database configured (MQ_DATABASE_URL variable), as the official instance does. |
Feature services
These providers serve specific features. If the feature is turned off or you do not use it, no data goes to them.
| Provider | Purpose | Data involved | Region | When it is used |
|---|---|---|---|---|
| Google (Gemini API) | Summaries, briefings and analyses by artificial intelligence (Gemini model). | Only data classified as public: text from public feeds and the AI Analysis question, after a filter that rejects personal data patterns. Text from Cases, Dossier and OSINT is never sent, because the provider has no data processing agreement (DPA). | Google infrastructure. The processing region is not disclosed by the API. | When the instance has a Gemini key configured and you request an analysis. Without a key, the screens show a summary without AI. |
| Resend | Transactional email: account approved notice, invitation and password reset. | The recipient's email address and the message text, with a single-use link. The server stores only the hash of that link. | Not pinned in the repository. | When the Resend key and sender are configured. Without them, no email is sent: the panel shows the link for the administrator to pass on. |
| ipapi.co, freeipapi.com, ip-api.com | Approximate geolocation by IP, to open the map near you. The three are queried in cascade: the next one is only used if the previous one fails. | Your apparent IP address. The result is not stored. | Outside Brazil. The region is not disclosed by the providers. | A few seconds after the map opens. If you interact with the page before that, the lookup is cancelled. |
| Your browser's push service (for example, Google, Mozilla or Apple) | Deliver alerts as notifications even with the tab closed. | The delivery address generated by the browser and the end-to-end encrypted notification (RFC 8291 standard). The push service cannot read the content. | Set by the browser vendor. | Only if you turn on Web Push alerts, an optional feature. |
What is not on this list
- Public data sources (agencies, open catalogues, IP and domain reputation services etc.). They receive the platform's lookups and, in some features, the term you search, but they do not process data on our behalf. They are listed in the Privacy Policy.
- Usage statistics (Umami), when enabled: they run on our own server, not at a third party, and do not receive your IP address.
- Webhook destinations that you register yourself in the alert channels. You choose the destination, and each delivery carries an HMAC signature.
- The backend of the scanning tools (RECON), when present, is operated separately by the instance owner.
International transfer
The database is in Brazil. Other providers on this list may process data outside the country. The LGPD regulates this kind of transfer in articles 33 to 36.
Changes to this list
When a provider is added, removed or changes role, we update this page and the "Last updated" date at the top.