Witness sub-processors
Updated 20 October 2026.
These are the companies that process data on our behalf, what each one receives, and where it runs. Nobody outside this list receives anything. We add a name here before wiring it in.
Always
| Company | What for | What it receives | Where |
|---|---|---|---|
| Fly.io fly.io/legal |
Hosting | Everything the service holds, on one machine and its encrypted volume. Fly operates the machine; it does not read the data. | London, United Kingdom |
| Postmark (ActiveCampaign) postmarkapp.com/privacy-policy |
Transactional email | The recipient's address and the content of each message we send: sign-in verification, invitations, coverage invitations, trial and billing notices, recovery notices. Once a day, a list of new accounts' addresses that the service sends to our own mailbox. | United States |
| Google Workspace workspace.google.com/terms/dpa_terms.html |
Our own email | Messages you send to our addresses, such as support@apertrue.photo, and our replies. The daily list of new accounts arrives there too, with each address, when it signed up and how far its set-up has got. We delete each list within 30 days of receiving it. No other account record is sent there. | United States and other Google data centres |
| Stripe stripe.com/privacy |
Payments | Your email, the plan you chose, and payment details you enter on Stripe's own pages. Card details never reach us. Stripe is a separate controller for payment data. | United States |
| drand (League of Entropy) | Public randomness beacon | The Witness app on your Mac fetches the beacon's latest public value at the start of a call, so drand's servers see an ordinary web request from your machine and nothing else. We send it nothing. | Distributed; mirrors run by Cloudflare and others |
Only when this deployment switches it on
Not every deployment sends error reports. A private or pilot service with no reporting address set sends nothing, and the console says so in its own policy by reaching no origin but ours. Nor does every deployment keep customer records in HubSpot. One with no HubSpot token set sends nothing there.
| Company | What for | What it receives | Where |
|---|---|---|---|
| Sentry (Functional Software) sentry.io/privacy |
Error reporting | Only when this deployment has it switched on. What goes: the error and where in our own code it happened, the release, the browser or macOS version, and the request id that matches a line in our logs. What does not: your address, your IP address, anything about a call, any link, any video frame. A report whose text mentions any of those is discarded rather than trimmed. Nothing is sent from the verification page, which reaches no service but ours. | United States |
| HubSpot legal.hubspot.com/privacy-policy |
Customer records | Only when this deployment has it switched on. For each organisation it receives the name, the plan, a count of the members and our identifier for it. For each of the organisation's administrators it receives their email address. It never receives members who are not administrators, people an organisation asks to verify, or an account with no organisation, and it receives nothing about calls, identity or devices. An administrator's record is permanently deleted at the next comparison with our own records, normally about ten minutes after their account is deleted or their role ends. A fault, or a large removal waiting for our check, can delay it. An organisation's record is removed when it goes or has no administrator left. HubSpot can take up to 30 days to purge a permanently deleted record and keeps a removed company in its recycling bin for up to 90 days. | European Union (HubSpot's EU data centre) |
Only when you use the feature
| Company | What for | What it receives | Where |
|---|---|---|---|
| Google policies.google.com/privacy |
Google sign-in, if you choose it; the work-address proof | For sign-in, Google learns that you signed in to Witness and gives us your address and an identifier. For the work-address proof, Google learns that the Witness app on your Mac requested a sign-in; the token it returns is turned into a proof on your Mac and never reaches us. | United States |
| ZKPassport zkpassport.id |
The passport check | Serves the proving circuits and certificate lists the Witness app on your phone downloads. The app reads and proves your passport on your phone, so ZKPassport sees your phone's IP address and the time of each download, and nothing from your passport. | Not stated by ZKPassport; treated as outside the United Kingdom |
| Alchemy alchemy.com/policies/privacy-policy |
Reading the current list of passport authorities from a public blockchain during the passport check | Your phone's IP address and the time, when your phone asks which certificate list is current. Nothing about you or your passport. Our service also asks Alchemy whether a certificate list is current, when it checks a passport proof and when it tells your phone which list to use; those requests carry the list's identifier and no personal data. | United States |
| Aztec Labs aztec.network |
A public setup file the passport proof needs | Your phone's IP address and the time, when your phone downloads the file. Nothing about you or your passport. | Not stated by Aztec; treated as outside the United Kingdom |
| Apple apple.com/legal/privacy |
Sign in with Apple, if you choose it, in the phone app or on the website; attesting the Witness apps: the phone app for the face check, and on macOS 27 the Mac app for each enrolment and call | For sign-in, Apple learns that you signed in to Witness and gives us an identifier and your address, or an Apple address that forwards to yours if you choose Hide My Email. For attestation, an attestation that the Witness app on your phone or Mac is genuine and, on the Mac, that its security settings are on, from Apple's App Attest service. It identifies the app and a key on your device, not you; Apple does not receive your calls, pictures or identity from it. | United States |
Transfers outside the United Kingdom
Where a company above processes data outside the United Kingdom, the transfer rests on the mechanism that company's own data processing terms state: the UK extension to the EU-US Data Privacy Framework where the company is certified under it, or the UK's international data transfer addendum to the standard contractual clauses. Copies of the relevant terms are available from support@apertrue.photo.
Not on this list, on purpose
No analytics, advertising, session-recording or tracking company receives anything from any Witness page or app. There are none.