Witness sub-processors

Updated 9 September 2026.

These are the companies that process data on our behalf, what each one receives, and where it runs. Nobody outside this list receives anything. We add a name here before wiring it in.

Always

Company	What for	What it receives	Where
Fly.io fly.io/legal	Hosting	Everything the service holds, on one machine and its encrypted volume. Fly operates the machine; it does not read the data.	London, United Kingdom
Postmark (ActiveCampaign) postmarkapp.com/privacy-policy	Transactional email	The recipient's address and the content of each message we send: sign-in verification, invitations, sponsorship invitations, trial and billing notices, recovery notices.	United States
Stripe stripe.com/privacy	Payments	Your email, the plan you chose, and payment details you enter on Stripe's own pages. Card details never reach us. Stripe is a separate controller for payment data.	United States
drand (League of Entropy)	Public randomness beacon	The Witness app on your Mac fetches the beacon's latest public value at the start of a call, so drand's servers see an ordinary web request from your machine and nothing else. We send it nothing.	Distributed; mirrors run by Cloudflare and others

Only when this deployment switches it on

Not every deployment sends error reports. A private or pilot service with no reporting address set sends nothing, and the console says so in its own policy by reaching no origin but ours.

Company	What for	What it receives	Where
Sentry (Functional Software) sentry.io/privacy	Error reporting	Only when this deployment has it switched on. What goes: the error and where in our own code it happened, the release, the browser or macOS version, and the request id that matches a line in our logs. What does not: your address, your IP address, anything about a call, any link, any video frame. A report whose text mentions any of those is discarded rather than trimmed. Nothing is sent from the verification page, which reaches no service but ours.	United States

Only when you use the feature

Company	What for	What it receives	Where
Google policies.google.com/privacy	Google sign-in, if you choose it; the work-address proof	For sign-in, Google learns that you signed in to Witness and gives us your address and an identifier. For the work-address proof, Google learns that the Witness app on your Mac requested a sign-in; the token it returns is turned into a proof on your Mac and never reaches us.	United States
ZKPassport zkpassport.id	The passport check	Relays messages between your phone and your browser during the check, encrypted between the two with keys the relay does not hold, and serves the proving circuits and certificate lists your phone downloads. Your passport is read and proven on your phone; the relay carries ciphertext.	Not stated by ZKPassport; treated as outside the United Kingdom
Apple apple.com/legal/privacy	Attesting the Witness phone app for the face check	An attestation that the app on your phone is genuine, from Apple's App Attest service. No personal data; the attestation identifies the app, not you.	United States

Transfers outside the United Kingdom

Where a company above processes data outside the United Kingdom, the transfer rests on the mechanism that company's own data processing terms state: the UK extension to the EU-US Data Privacy Framework where the company is certified under it, or the UK's international data transfer addendum to the standard contractual clauses. Copies of the relevant terms are available from support@apertrue.photo.

Not on this list, on purpose

No analytics, advertising, session-recording or tracking company receives anything from any Witness page or app. There are none.