| OPENOSINT | Sub-processors | 2026-08-30 |
SUB-PROCESSORS
This page covers the two surfaces the operator directly hosts and controls: OpenOSINT Cloud (the paid API) and the public demo at this site. It lists every external party that receives query content, result content, credentials, or personal data when you use either surface, built directly from the deployed code and infrastructure configuration rather than from a general description of the product. This list is referenced in our Privacy Policy (§5). Last updated: 2026-08-30.
If you self-host OpenOSINT (the open-source CLI, MCP server, or local web UI) with your own API keys, this page does not apply to that use — you are the controller for that processing, and your relationship with whichever providers you configure is your own. See our Privacy Policy (§3).
OPERATOR-ENGAGED SUB-PROCESSORS
These parties act on the operator's own account or key, to provide OpenOSINT Cloud and/or the public demo as a service. They are true sub-processors of the operator.
| Sub-processor | Surface | What it receives | Location | Transfer mechanism |
|---|---|---|---|---|
| Gumroad | Digital-product purchases (AI OSINT Prompt Pack, Operator's Playbook, Setup Sprint) | Payment details, order data (email, product purchased). Acts as Merchant of Record; the operator never sees full card details. OpenOSINT Cloud access itself is invite-only and does not go through a payment processor. | USA | Standard Contractual Clauses (SCCs) |
| Heroku (Salesforce) | OpenOSINT Cloud only | Hosts the Cloud API and its Postgres database: account records, credit balances, and encrypted BYOK credentials. Does not receive query/target content — the Cloud API returns tool results to the caller without persisting them (see cloud/routes/enrich.py). |
USA | Standard Contractual Clauses (SCCs) |
| DigitalOcean | Public demo only | Hosts the demo web application. Receives every HTTP request to the demo, including visitor IP addresses and the input to every tool run there — including the keyless tools (WHOIS, DNS, domain enumeration, email/username enumeration, etc.), which remain fully interactive in demo mode. Was not previously disclosed on this page. | USA (and wherever the region is provisioned) | Standard Contractual Clauses (SCCs) |
| IP2Location | OpenOSINT Cloud only | IP address submitted to search_ip2location. This is a sponsored, platform-tier lookup by design — the operator's own key is used for every Cloud customer, not BYOK (see cloud/key_sources.py). On the public demo, this tool now requires your own key; the operator's key cannot be used there. |
Malaysia / USA | Standard Contractual Clauses (SCCs) |
| GitHub (OAuth login) | OpenOSINT Cloud dashboard only | Used as a sign-in identity provider for the Cloud dashboard: receives the OAuth authorization request and returns your GitHub user ID and (if public) email address. Not the same relationship as the search_github OSINT tool — see the BYOK table below for that. |
USA | Standard Contractual Clauses (SCCs) |
| Google (OAuth login) | OpenOSINT Cloud dashboard only | Used as a sign-in identity provider for the Cloud dashboard: receives the OAuth authorization request and returns your Google account subject ID and email address. | USA | Standard Contractual Clauses (SCCs) |
NOT USED TO PROCESS YOUR QUERY OR PERSONAL DATA
These providers do not receive data from OpenOSINT Cloud or the public demo, even though the underlying open-source project supports them for self-hosted use. Each surface is verified and stated independently below — a fact about one is not assumed to hold for the other.
| Provider | OpenOSINT Cloud | Public demo |
|---|---|---|
| Anthropic (Claude) | Not used. The Cloud API has no chat or AI feature at all — it is a tool-only REST/MCP gateway (cloud/tools.py, cloud/routes/mcp_gateway.py); nothing in cloud/ references Anthropic. |
Not used. The demo's chat endpoint is disabled unconditionally in demo mode, regardless of whether the operator's own key or a visitor-supplied key would be used. |
| Any OpenAI-compatible endpoint | Not used — same basis as Anthropic above: no chat feature exists in the Cloud API codebase. | Not used. Blocked by the same unconditional chat-endpoint disable as Anthropic above, including a visitor-supplied alternate backend. |
| HaveIBeenPwned | Not used. search_breach is deliberately excluded from both the Cloud API's tool list and its MCP gateway's tool registrations — it is not wired in, not a missing key. |
Not used. search_breach is blocked unconditionally in demo mode — not just a missing key — because the operator does not want to be the entity making a breach lookup available to an anonymous visitor on a non-consenting third party, regardless of whose API key would be used. |
If you self-host OpenOSINT (CLI, MCP server, or local web UI) with your own key for any of these, that processing is between you and the provider — see the scope note at the top of this page.
BYOK DATA SOURCES
For these tools, OpenOSINT Cloud and the public demo require your own API key or account — the operator's key is never used, and the provider processes your query directly under your account and their own terms:
- ipinfo.io —
search_ip(IP geolocation) - VirusTotal —
search_virustotal - Censys —
search_censys(compound API ID + secret) - AbuseIPDB —
search_abuseipdb - Shodan —
search_shodan. Not currently reachable via OpenOSINT Cloud at all (excluded from the Cloud API's v1 allow-list). On the public demo it requires your own key. The code is written to support an operator-held key for this tool in the future (seecloud/key_sources.py) — if that changes, this entry will move to the table above. - GitHub — the
search_githubOSINT tool (distinct from the OAuth login above) works unauthenticated against GitHub's public API; a personal token only raises the rate limit and is never the operator's own. - Bright Data —
search_dorks_live,scrape_url,search_footprint. The operator has a referral relationship with Bright Data (a signup-commission link is shared in project documentation) but does not hold or use its own Bright Data key on either OpenOSINT Cloud or the public demo — every request runs on your key.
KEYLESS THIRD-PARTY QUERIES
A few tools query third-party services directly, without any API key at all, as an inherent part of what the lookup does — for example, checking whether an email or username is registered on a given platform (search_email, search_username), reading a domain's public WHOIS record (search_whois), resolving DNS/subdomains (search_dns, search_domain), or searching public paste dumps (search_paste). These can reach dozens to hundreds of third-party sites and registries per request. The operator has no account, key, or ongoing relationship with any of them — no more than a browser has one with every site it's pointed at — so they are not listed individually here.
CHANGES
This page was rewritten on 2026-08-30 after an internal accuracy review found it named a hosting provider (Heroku) the public demo does not run on, classified Shodan as a customer-supplied (BYOK) source when the code configures it as an operator-held key, and omitted Anthropic and DigitalOcean entirely. We will update this page when sub-processors are added or removed. Material changes will also be communicated via the Privacy Policy update mechanism. Contact commercial@openosint.tech with questions.