Everyone who touches the data.
A complete list. If we add one we will add it here.
| Provider | What it does | Location |
|---|---|---|
| Cloudflare | Site and worker hosting, DNS, KV storage for page counts and registry records, inbound email routing | Global CDN, EU entity |
| Plausible | Cookieless aggregate analytics | EU |
| Resend | Outbound email | EU (Ireland) |
| Google Workspace | Mailbox where inbound mail is delivered and read | EU/US |
| Anthropic | AI model (Claude): reads the text you paste into Evidence Check, through the API; in engagement work, drafts and checks deliverables with model training switched off | US |
| Sentry | Error monitoring for the registry worker; exception type, message and stack only, payloads scrubbed | US |
| GitHub | Public source code, issues and discussions | US |
| Sigstore | RFC 3161 timestamps and the Rekor transparency log for registry receipts; public by design | Public infrastructure |
Engagement work is different. If an engagement involves your documents, what we may touch and where is fixed in the engagement agreement before anything starts: a mutual NDA comes before any document exchange, and a data processing agreement is available on request.
We draft and check with Claude (Anthropic) only. Client documents are not entered into other AI tools, and model training is switched off on the Claude account we use for client work. Sensitive test data does not need to leave your systems: its identity and a hash are enough. Only hashes, never document content, go to the public registry. Every deliverable is reviewed and signed by the founder on behalf of Falsify OÜ. We do not train models on client material.