Subprocessors

1. Definitions

• Subprocessor: a third-party vendor that processes customer data on Aegara's behalf in the course of providing the service. Aegara is the processor of your data; these vendors are our subprocessors.
• Customer data: the records your systems send to Aegara, and what Aegara keeps about your organization to run the service: its account, team, monitoring rules, alerts and sensitivity classifications.

2. Active subprocessors

These are the third parties your data actually touches when you use Aegara today.

• Render, Inc.

  What it does

  Application hosting + managed Postgres + service logs

  Where it runs

  Render's Oregon (US-West) region. Managed Postgres, US region.

  What data it handles

  All AI Action Events, customer rows, policies, alerts and sense classifications, and Aegara's service logs, which are listed under Render below.

• Resend (Resend.com, Inc.)

  What it does

  Transactional email delivery (account verification, password reset, alert notification emails)

  Where it runs

  Sent from noreply@aegara.ai. Resend infrastructure is US-region.

  What data it handles

  Recipient email addresses, the alert email recipient you can set on your organization's Profile page, and the content of each email Aegara sends, of the kinds listed below. No prompt, no response, no file and no value is in any email, because none of them reaches Aegara. An alert email carries the monitoring rule's name and severity, the AI system's name, the kind of action, its sensitivity, the one-line summary Aegara writes for the event, and a link to the portal.

Render, Inc.

Aegara runs on Render's servers: each event Aegara receives is handled by a Render-hosted service and stored in a Render-managed Postgres database. An outage or a compromise at Render affects Aegara and the data it holds.

Service logs. Render keeps Aegara's service logs. No prompt, no response, no file and no value reaches Aegara, so none of them can appear in these logs. The logs can contain:

• Your organization's id, and the ids of your events, team members, alerts, monitoring rules and contact requests
• Timestamps
• The names of your API keys and monitoring rules. Your first key's name includes your company name.
• The names you give your AI systems
• The address of each webhook you set up, and the network address it resolves to, each time Aegara tries to deliver to it
• The text of an error, and the address that was requested, when something fails on Aegara's side

Security posture: See render.com/security for their published certifications and security program. Their privacy terms are at render.com/privacy. Render makes a DPA available on request; partners on a Design Partner Agreement or paid contract who need one signed should email support@aegara.ai and we'll initiate.

Resend (Resend.com, Inc.)

Resend is the email service Aegara uses for:

• Account verification
• Password reset
• A new verification link, when you ask for one
• Team invitations
• Messages you send us through our contact form
• Alert notifications
• The receipt when your organization's data is deleted

Resend receives only the addresses Aegara emails and the content of those emails, never your event records.

Security posture: See resend.com/security for their security program. Their privacy policy is at resend.com/legal/privacy-policy. Resend makes a DPA available; same path as Render: email support@aegara.ai.

Cloudflare, as part of Render

Render protects the services it hosts with Cloudflare's network, so every request to aegara.ai passes through Cloudflare on its way to Render. That includes the records your integration sends and every page of the portal. Cloudflare is part of the service Render provides, and Render describes it at render.com/docs/ddos-protection.

jsDelivr

The charts on the portal's overview use an open-source charting library, which your browser downloads from jsDelivr, a public service that delivers open-source code. jsDelivr receives that request, which carries your network address, your browser's details and the fact that it came from aegara.ai. It receives nothing from your Aegara account.

3. Your AI providers are not Aegara's subprocessors

Your AI providers (OpenAI, Anthropic, Google Gemini, Cohere, AWS Bedrock) are your subprocessors, not Aegara's. Aegara is not in the network path between your application and your AI provider on any integration path. Your application calls your provider directly, using your own credentials, under your own contract with them. Aegara never receives, forwards, or holds those credentials, and never establishes a relationship with your provider on your behalf.

4. Data deletion (GDPR Article 17 erasure)

If you ask Aegara to delete your organization's data, Aegara removes it outright, rather than marking it as deleted. The deletion covers every kind of customer data Aegara stores:

• Events
• API keys
• Your organization's account
• The people in your organization
• Invitations you sent
• Billing records
• The record of alert emails sent
• Monitoring rules
• Alerts
• Sensitivity classifications, your feedback on them and your corrections
• The record of administrative actions on your account
• Events still waiting to be stored
• The AI systems Aegara found in your records
• Requests you sent us through the contact form from an email address on your account, including a deletion request sent that way

The deletion is all or nothing: either every one of these is deleted, or none is.

How to request: Use the account-deletion link on the privacy policy. It opens a form that records your request and gives you a reference. You can also email support@aegara.ai from an address on your account and ask for your organization's data to be deleted. Either way, Aegara carries out the deletion and emails you a receipt showing how many records of each kind were removed.

What gets deleted: everything Aegara directly controls, including any events still on their way into storage at the time of the request. Those are saved first and deleted with the rest.

What this deletion does not reach:

• Resend keeps delivery records for the emails we sent you, including the deletion receipt, which we send after the deletion runs. Resend retains them per their own policy. To delete those, contact Resend directly via resend.com/legal/privacy-policy.
• Render keeps Aegara's service logs, which can contain the items listed under Render above, for the length of its log retention. Aegara has no way to delete them early; they are removed when that retention ends.
• Production backups: any backup taken before the deletion still holds the deleted data until that backup expires.

Aegara does not rebuild deleted data from any other source, does not keep anonymized totals of it, and does not keep deleted records under a hidden flag.

5. Process for adding a new subprocessor

When Aegara intends to add a new subprocessor:

1. This page is updated when the new subprocessor starts processing data, so the list here always matches the services in use.
2. Partners on a Design Partner Agreement or paid contract that contains the standard subprocessor-notification clause are notified by email, at the address in their agreement, at least 30 days before the new subprocessor processes their data, unless the change is required by law or to fix a security incident.

Privacy Policy · Back to home