Start here
The data your agent scans is processed inside your own cloud account and is never transmitted to us, which means it is never transmitted to any provider on this page either. What follows covers the account data, findings and operational data held by our control plane.
Current sub-processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Compute, storage and backups for the control plane, database and this website | All control-plane data: account records, findings, audit logs | Falkenstein, Germany (EU) |
| Resend | Transactional email: verification, password reset, invitations, alert notifications | Recipient name and email address, message content | United States. Resend runs on Amazon Web Services, which is therefore an onward sub-processor for email delivery only. |
Conditional, not always engaged
| Provider | Purpose | Data processed | When |
|---|---|---|---|
| Google (Gemini API) | Phrasing remediation recommendations | Aggregate counts, risk distribution and data-type category names only. No resource names, no account identifiers, no sampled content, no matched values. | Only where an external model is configured. A self-hosted model keeps this entirely in-house, and a fixed template library is used if neither is available. |
The distinction matters: this is the only provider on the page that touches anything derived from your scans, and what it receives is a statistical summary. The exact payload is described on thesecurity page.
Where your data physically sits
The control plane runs in the European Union, in Falkenstein, Germany. Email is the one component that leaves the EU, because our email provider operates from the United States. The only personal data in that path is a recipient's name, their email address and the content of the message being sent to them. Findings, scan results and audit logs are never emailed.
What is deliberately absent
We do not use analytics, advertising, session-recording, customer-messaging or A/B-testing providers on this website or in the product. There is no Google Analytics, no advertising pixel and no chat widget. That is a choice, and it is why this list is short.
Changes
Before we add a sub-processor that will process customer data, we will update this page and notify account administrators by email. If you object to a new sub-processor on reasonable grounds, contact us and we will work through it with you; if it cannot be resolved you may terminate without penalty.
To be notified of changes, email privacy@argusdspm.com and ask to be added to the sub-processor notification list.