Subprocessors
The providers that process data on our behalf, what they process, and how changes are announced.
Last updated: July 27, 2026
BountEx Labs, LLC ("Riskora") engages the following subprocessors to provide the Service. This page is kept current in accordance with Section 5 of our Data Processing Agreement.
Current subprocessors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Managed PostgreSQL database, authentication, scan-record storage | Account data, queried wallet addresses, scan records | Singapore (AWS ap-southeast-1) |
| Amazon Web Services, Inc. | Underlying cloud infrastructure (via Supabase) | Same as Supabase — no direct access by AWS | Singapore (ap-southeast-1) |
| OpenRouter, Inc. | AI-generated risk explanations (only when explicitly requested per scan) | Queried wallet address and scan metadata — never account data or user PII | United States |
| Public mempool-compatible nodes | Retrieval of public blockchain data for scoring | Queried wallet addresses (public on-chain data) | Various (rotating providers) |
| Amazon Web Services, Inc. (frontend) | Web application hosting and delivery | IP addresses and request metadata in access logs | Singapore (ap-southeast-1) |
Change policy
- This page is updated before any subprocessor is added or replaced.
- Material changes are additionally announced by email to registered customers at least 14 days in advance.
- You may object to a change on reasonable data-protection grounds within that period by emailing privacy@riskora.co, per Section 5 of the DPA.
Flow-specific notes
- AI explanations are generated per-scan and only on explicit request. The payload contains the wallet address and its scan results — nothing about your account, organization, or users.
- Blockchain lookups behave like any block-explorer query: the address is public on-chain data, and queries are distributed across redundant nodes for resilience.
- Payment processing (when billing is enabled) is handled by a PCI-DSS-compliant payment processor; card details never touch Riskora servers.