Subprocessors

A subprocessor is a third party engaged by Guard.ch (operated by Zesiger.net) to process personal data on our behalf in order to deliver the service. This register identifies each such party, its role, the categories of personal data it processes, the location of the processing and the transfer safeguard that authorises it.

For investigation content, Guard.ch acts as a processor on the customer's documented instructions, and the vendors that touch that content (durable storage, the browser nodes, the AI analysis providers) are subprocessors within the meaning of Article 28(2) and (4) GDPR. For account, billing, security and platform data, Guard.ch acts as a controller, and the corresponding vendors are our processors. Both categories are listed in this register for transparency, in the same format. The role split between processor and controller activities is set out in Section 6.1 of the Privacy Policy.

This page is the public register referenced by our Data Processing Agreement. Where this register and the Data Processing Agreement conflict on a material point, the Data Processing Agreement prevails for the contracting customer.

We update this register at least thirty (30) days before adding or replacing a subprocessor that processes customer personal data, so that customers can review the change and object before it takes effect. Changes that do not affect how customer personal data is processed, stored or transferred (for example a vendor's corporate rename, an address update, or the removal of a vendor) are reflected on the next routine update without the notice period.

Customers and prospects can subscribe to written change notifications by sending the word "subscribe" to [email protected]. The mailing list is used only for subprocessor and legal-document notices; you can unsubscribe at any time by replying with "unsubscribe".

All durable customer data (the production database, account and billing records, workspace assets and backups) lives in a single primary region: Hetzner's Helsinki facility in Finland (EEA). Investigation content is not stored anywhere: it exists only inside the running container and is destroyed with it, and there is no multi-region replication. Edge nodes in Singapore, Salt Lake City and Beauharnois run the isolated investigation containers and stream them to the user over WebRTC; the browser's working files exist on an edge node only inside the container's writable layer while the investigation runs, after which the container and its writable layer are destroyed.

The edge nodes are dedicated servers rented from the data-centre providers listed below for each location. Provider legal terms and transfer-impact details are available to customers on written request to [email protected].

Cloudflare provides DNS for guard.ch and serves the guard.ch web frontend from its edge network. Backend API requests from the dashboard, and everything a running investigation shows, are served from our own origin infrastructure; Cloudflare's role is limited to DNS, delivery of the web frontend and Turnstile. Cloudflare Turnstile runs on the registration, sign-in, email-code verification, password reset and investigation launcher forms to mitigate automated abuse.

Guard.ch supports passkeys, email-and-password sign-in and federated sign-in with Google or Microsoft. Federated providers receive data only when the user actively chooses that sign-in method; users who sign in with a passkey or email and password cause no data to flow to the providers below. When acting as identity providers, Google and Microsoft also process the sign-in event under their own terms as independent controllers of their respective identity services; they are listed here for transparency.

Stripe processes every payment for Guard.ch subscriptions. Guard.ch contracts with Stripe Payments Europe, Ltd.; processing may also involve Stripe, Inc. and other Stripe group entities under Stripe's data processing agreement. Guard.ch never receives or stores full card numbers: the payment method is tokenised at Stripe, and only the token, the card brand and the last four digits are stored in our billing records. For certain activities, such as fraud monitoring and its own regulatory compliance, Stripe acts as an independent controller as described in its own privacy documentation.

Outbound transactional email (account verification codes, one-time sign-in codes, contact-form confirmations and similar account and service notices) is sent from [email protected], the shared transactional mail address of the browser.lol and guard.ch platform, through the Google Workspace SMTP relay. Investigation capture content is never included in transactional email.

Guard.ch uses third-party analysis services for narrowly scoped purposes: large language model inference for the AI analysis and summarisation features of an investigation, web search that lets the model cross-reference the investigated host against the open web, hostname and domain lookups that feed the automated verdict, and anomaly detection over aggregated operational logs. All model inference is contracted through a single provider, OpenRouter, Inc., which routes each request to the model vendor selected for that task; Guard.ch holds no direct contract with those vendors, and they act as sub-processors engaged by OpenRouter. Among the providers below, OpenRouter and Serper are the only ones that receive user-submitted investigation content: OpenRouter receives the content sent to the AI feature, and Serper receives the search queries the model runs, which contain the investigated domain. Google Web Risk and WhoisJSON receive a hostname or domain name only. PostHog provides first-party product analytics for the guard.ch website and dashboard (usage events, interface session recordings and error reports) and receives no investigation capture content.

The enrichment shown in an investigation (IP geolocation, ASN data, network metadata, threat and tracker classifications, domain popularity) is produced from reference datasets that we license or obtain from public sources, download on a schedule, and query inside our own database. These providers supply data to us; they do not receive or process customer personal data and are therefore not subprocessors. They currently include MaxMind (GeoLite2 City and ASN), PeeringDB (via CAIDA snapshots), abuse.ch (Feodo Tracker, ThreatFox, URLhaus) and the Tranco list.

Beyond the analysis providers listed above, three categories of reference lookup leave our infrastructure while an investigation runs: whois/RDAP queries for the registrable domain of the investigated URL, the Google Web Risk lookup, and DNS resolutions of the investigated hostname. The whois/RDAP queries go first to public directory infrastructure, the responsible registry or registrar and the public RDAP redirector used to discover it, which receives only the investigated domain name and is not subprocessing under a contract with Guard.ch. Where those public sources return nothing usable, the same domain name goes to the commercial WHOIS API listed in the analysis section above, which is subprocessing and is disclosed there. The DNS resolutions go to a panel of public resolvers operated by third parties, filtering ones alongside unfiltered ones, because whether a resolver still answers for a hostname is itself the signal; each operator receives only the hostname being resolved, under its own public terms rather than a contract with Guard.ch.

Guard.ch is operated from Switzerland. Switzerland is recognised as adequate by the European Commission and under the UK adequacy regulations, so personal data can move between the EEA, the UK and our Swiss establishment without additional transfer safeguards. Durable customer data stays in the EEA (Hetzner, Helsinki); only the ephemeral edge processing and the specific vendor services listed above involve processing outside the EEA and Switzerland.

For US vendors that are certified under the EU-US Data Privacy Framework and the Swiss-US extension, as identified per vendor in this register against the official DPF list, that certification is the primary transfer mechanism and the EU Standard Contractual Clauses operate as a fallback. For all other transfers outside the EEA, Switzerland and the UK, the EU Standard Contractual Clauses (2021/914) and the Swiss FDPIC-recognised equivalent are the baseline mechanism, supplemented by the European Commission's adequacy decision for the Canadian commercial sector (PIPEDA) for the Beauharnois edge location. Where the UK GDPR applies to an onward transfer, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses is used where required. Guard.ch itself is a Swiss entity and is not, and cannot be, certified under the Data Privacy Framework; we do not claim otherwise.

We maintain transfer impact assessments for the non-EEA destinations and make a copy (redacted where necessary) available to customers on written request to [email protected]. The canonical description of our transfer posture is Section 9 of the Privacy Policy.

Customers may object to the engagement of a new or replacement subprocessor on reasonable data protection grounds (for example a documented incompatibility with the customer's own regulatory regime). Objections must be sent in writing to [email protected] within fourteen (14) days of the change notification, and in any event before the announced change takes effect.

On receipt we will work with the customer in good faith to find a workable alternative. If no alternative can reasonably be agreed before the change takes effect, the customer may terminate the affected portion of the service without penalty and receive a pro-rata refund of prepaid fees for the unused term, consistent with the Terms of Service and the Data Processing Agreement.

Questions about this register, requests for the underlying data processing agreements or transfer impact assessments, subscription requests and objections all go to [email protected]. Postal mail reaches Zesiger.net at the address published in the Imprint.