Trust / Legal

Sub-processors

Last updated: May 2026

This page lists third-party sub-processors that may process Customer Personal Data on behalf of Panguard AI, as an annex to Section 7 of the Data Processing Agreement.

We provide at least 30 days written notice before adding or replacing a sub-processor. Customers may object on reasonable data-protection grounds; if unresolved within 30 days of objection, the Customer may terminate the master agreement without penalty per DPA Section 11.

Current Sub-processors

Sub-processor	Purpose	Location	Evidence
Supabase Inc.	Workspace database, user authentication, audit logs	United States	DPA Security / SOC 2
Stripe, Inc.	Billing, payment processing, invoicing	United States	DPA Security / SOC 2
Vercel Inc.	Marketing site + customer dashboard hosting (panguard.ai, app.panguard.ai)	United States	DPA Security / SOC 2
Cloudflare, Inc.	DNS, CDN, DDoS protection, Web Application Firewall	United States	DPA Security / SOC 2
Functional Software, Inc. (Sentry)	Application error monitoring, performance tracing	United States	DPA Security / SOC 2
Anthropic, PBC	Migrator LLM enrichment at build time only. Customer Data is NOT transmitted at runtime by default; only Sigma / YARA rule text submitted via the Migrator CLI flows through.	United States	DPA Security / SOC 2
Fly.io, Inc.	Threat Cloud hosting (tc.panguard.ai) where Enterprise customer elects hosted TC	United States	DPA Security / SOC 2
GitHub, Inc.	Source code hosting, CI/CD workflows, security advisory coordination	United States	DPA Security / SOC 2
Google LLC (Google Workspace)	Vendor email ([email protected], [email protected]), calendar, documents	United States	DPA Security / SOC 2

Scope of Processing

By default, Customer Data is processed entirely within Customer's environment (panguard-cli running locally, or Customer-hosted Docker deployment of Threat Cloud). No Customer Data leaves Customer infrastructure unless the Customer explicitly opts into Panguard's hosted Threat Cloud telemetry. Telemetry, when opted in, transmits only anonymized detection metadata (rule ID, timestamp, hashed agent identifier) — never payload contents.

Notification Preferences

To subscribe to sub-processor change notifications, email [email protected] with your Customer workspace name and notification recipient list.

This list is maintained by Panguard AI, Inc. Questions to [email protected]. Full data processing terms in the Data Processing Agreement and Privacy Policy.