Subprocessors

A subprocessor is a third party engaged by Guard.ch (operated by Zesiger.net) to process personal data on our behalf in order to deliver the service. This register identifies each such party, its role, the categories of personal data it processes, the location of the processing and the transfer safeguard that authorises it.

For investigation content, Guard.ch acts as a processor on the customer's documented instructions, and the vendors that touch that content (durable storage, edge capture nodes, the AI analysis providers) are subprocessors within the meaning of Article 28(2) and (4) GDPR. For account, billing, security and platform data, Guard.ch acts as a controller, and the corresponding vendors are our processors. Both categories are listed in this register for transparency, in the same format. The role split between processor and controller activities is set out in Section 6.1 of the Privacy Policy.

This page is the public register referenced by our Data Processing Agreement. Where this register and the Data Processing Agreement conflict on a material point, the Data Processing Agreement prevails for the contracting customer.

We update this register at least thirty (30) days before adding or replacing a subprocessor that processes customer personal data, so that customers can review the change and object before it takes effect. Changes that do not affect how customer personal data is processed, stored or transferred (for example a vendor's corporate rename, an address update, or the removal of a vendor) are reflected on the next routine update without the notice period.

Customers and prospects can subscribe to written change notifications by sending the word "subscribe" to [email protected]. The mailing list is used only for subprocessor and legal-document notices; you can unsubscribe at any time by replying with "unsubscribe".

All durable customer data, including investigation captures, the production database and backups, lives in a single primary region: Hetzner's Helsinki facility in Finland (EEA). There is no durable copy of a capture anywhere else and no multi-region replication. Edge nodes in Singapore, Salt Lake City and Beauharnois run the isolated investigation containers and stream them to the user over WebRTC; capture artefacts exist on an edge node only inside the container's writable layer for the duration of the investigation and the upload to Helsinki, after which the container and its writable layer are destroyed.

The edge nodes are dedicated servers rented from the data-centre providers listed below for each location. Provider legal terms and transfer-impact details are available to customers on written request to [email protected].

Cloudflare provides DNS for guard.ch and serves the guard.ch web frontend from its edge network. Backend API requests from the dashboard are served from our own origin infrastructure, and investigation capture content (recordings and replay artefacts) is served from the Helsinki origin; Cloudflare's role is limited to DNS, delivery of the web frontend and Turnstile. Cloudflare Turnstile runs on the registration, sign-in, email-code verification, password reset and investigation launcher forms to mitigate automated abuse.

Guard.ch supports passkeys, email-and-password sign-in and federated sign-in with Google or Microsoft. Federated providers receive data only when the user actively chooses that sign-in method; users who sign in with a passkey or email and password cause no data to flow to the providers below. When acting as identity providers, Google and Microsoft also process the sign-in event under their own terms as independent controllers of their respective identity services; they are listed here for transparency.

Stripe processes payments for Guard.ch subscriptions. Guard.ch contracts with Stripe Payments Europe, Ltd.; processing may also involve Stripe, Inc. and other Stripe group entities under Stripe's data processing agreement. Guard.ch never receives or stores full card numbers: the payment method is tokenised at Stripe, and only the token, card brand and last four digits are stored in our billing records. For certain activities, such as fraud monitoring and its own regulatory compliance, Stripe acts as an independent controller as described in Stripe's own privacy documentation.

Outbound transactional email (account verification codes, one-time sign-in codes, contact-form confirmations and similar account and service notices) is sent from [email protected], the shared transactional mail address of the browser.lol and guard.ch platform, through the Google Workspace SMTP relay. Investigation capture content is never included in transactional email.

Guard.ch uses third-party analysis services for narrowly scoped purposes: large language model inference for the AI analysis and summarisation features of an investigation, hostname reputation lookups that feed the automated verdict, and anomaly detection over aggregated operational logs. Among these providers, only OpenRouter (together with the inference provider it routes a given request to) receives user-submitted investigation content. Google Web Risk receives the checked hostnames only, and OpenAI receives aggregated operational telemetry only and never receives capture content.

The enrichment shown in an investigation (IP geolocation, ASN data, network metadata, threat and tracker classifications, domain popularity) is produced from reference datasets that we license or obtain from public sources, download on a schedule, and query inside our own database. These providers supply data to us; they do not receive or process customer personal data and are therefore not subprocessors. They currently include MaxMind (GeoLite2 City and ASN), PeeringDB (via CAIDA snapshots), abuse.ch (Feodo Tracker, ThreatFox, URLhaus) and the Tranco list.

Two runtime lookups leave our infrastructure during an investigation: whois/RDAP queries for the registrable domain of the investigated URL, which are sent to the public directory services of the responsible registry or registrar, and the Google Web Risk lookup listed in the analysis section above. The whois/RDAP queries disclose only the investigated domain name to public directory infrastructure and are not subprocessing under a contract with Guard.ch.

Guard.ch is operated from Switzerland. Switzerland is recognised as adequate by the European Commission and under the UK adequacy regulations, so personal data can move between the EEA, the UK and our Swiss establishment without additional transfer safeguards. Durable customer data stays in the EEA (Hetzner, Helsinki); only the ephemeral edge processing and the specific vendor services listed above involve processing outside the EEA and Switzerland.

For US vendors that are certified under the EU-US Data Privacy Framework and the Swiss-US extension, as identified per vendor in this register against the official DPF list, that certification is the primary transfer mechanism and the EU Standard Contractual Clauses operate as a fallback. For all other transfers outside the EEA, Switzerland and the UK, the EU Standard Contractual Clauses (2021/914) and the Swiss FDPIC-recognised equivalent are the baseline mechanism, supplemented by the European Commission's adequacy decision for the Canadian commercial sector (PIPEDA) for the Beauharnois edge location. Where the UK GDPR applies to an onward transfer, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses is used where required. Guard.ch itself is a Swiss entity and is not, and cannot be, certified under the Data Privacy Framework; we do not claim otherwise.

We maintain transfer impact assessments for the non-EEA destinations and make a copy (redacted where necessary) available to customers on written request to [email protected]. The canonical description of our transfer posture is Section 9 of the Privacy Policy.

Customers may object to the engagement of a new or replacement subprocessor on reasonable data protection grounds (for example a documented incompatibility with the customer's own regulatory regime). Objections must be sent in writing to [email protected] within fourteen (14) days of the change notification, and in any event before the announced change takes effect.

On receipt we will work with the customer in good faith to find a workable alternative. If no alternative can reasonably be agreed before the change takes effect, the customer may terminate the affected portion of the service without penalty and receive a pro-rata refund of prepaid fees for the unused term, consistent with the Terms of Service and the Data Processing Agreement.

Questions about this register, requests for the underlying data processing agreements or transfer impact assessments, subscription requests and objections all go to [email protected]. Postal mail reaches Zesiger.net at the address published in the Imprint.