Subprocessor List
Last updated: 9 August 2026
Carbon Verified (CarbonVerified.org) uses third-party services to deliver the assessment and verification service. This page lists every organisation that processes personal data on our behalf, what they do, what data reaches them, and where they operate.
1. Current subprocessors
The following organisations process personal data to help us run the service:
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Lovable Cloud (Supabase) | Hosting, database, authentication, file storage | All account, organisation, assessment and evidence data | EU (Frankfurt) and global edge network |
| Google PageSpeed Insights API | Analysing page performance and Core Web Vitals | The website URLs you submit for assessment | United States and global |
| Green Web Foundation | Checking whether a domain uses green hosting | Domain names submitted for assessment | Netherlands |
| Cloudflare | Content delivery network and DDoS protection | IP address, request metadata (transient) | Global edge network |
2. Changes to this list
We will update this list whenever we add or remove a subprocessor. For material changes, we will notify you by email before the change takes effect.
3. Data processing agreement
Business customers can review our standard Data Processing Agreement at /dpa. To sign a DPA, contact privacy@carbonverified.org.
4. Contact
For questions about our subprocessors, contact privacy@carbonverified.org.