The current list, with data classes and DPAs.
Garde1 uses a small number of vetted subprocessors to operate the platform. Each receives only the data classes documented below. The list below is every third party that processes customer data; we update it when it changes. The Privacy Policy and Customer Responsibility Matrix point here.
Current subprocessors
Amazon Web Services, Inc.
Primary hosting: ECS Fargate compute, Aurora PostgreSQL, private S3 object storage, DynamoDB, Lambda, CloudFront, Amazon Cognito (sign-in), SES (transactional email), and SQS (background queues).
| Data classes | All Customer Data, SPD, account metadata, sign-in records, audit logs, encrypted secrets. |
| Region | us-east-2; CloudFront edge locations are global. |
| DPA | AWS Customer Agreement + GDPR Data Processing Addendum executed. |
Microsoft Corporation (sign-in federation)
Microsoft sign-in, for users who choose it. Federated through Amazon Cognito.
| Data classes | Sign-in identity (email, display name) and authentication events for users who sign in with Microsoft. No business data. |
| Region | United States (Microsoft). |
| DPA | Microsoft Online Services Data Protection Addendum (DPA). |
Microsoft Corporation (Azure AI — OpenAI, Document Intelligence, Bing web search)
LLM inference for policy prose generation, evidence evaluation, and the in-app assistant, plus the embeddings behind in-app search (Azure OpenAI). Text extraction from uploaded evidence files (Azure AI Document Intelligence). Web search through Bing, via Azure, for some in-app assistant answers about a named vendor product (for example its FIPS or FedRAMP status), limited to vendor and government sites.
| Data classes | Control text, scope facts, evidence excerpts, uploaded evidence files, questionnaire answers. Web searches carry only the question about the named product, never evidence or scope data. See garde1.com/security/ai for the full list. |
| Region | United States (Azure, U.S. region). Bing web search is a global Microsoft service. |
| DPA | Microsoft Online Services DPA. Customer Data is not used to train or fine-tune any model, ours or a third party’s. |
Google LLC (sign-in federation and marketing-site analytics)
Google sign-in, for users who choose it, federated through Amazon Cognito. Google Analytics on garde1.com only, never in the app.
| Data classes | Sign-in identity (email, display name) and authentication events for users who sign in with Google. For Analytics: page views, device and browser metadata, and approximate location of garde1.com visitors. No business data. |
| Region | United States (Google). |
| DPA | Google’s data processing terms for its sign-in and Analytics services. |
Brandfetch
Vendor logos and company names in the app, looked up from the vendor or product names you type.
| Data classes | Vendor and product names typed in the app, and the browser request metadata (such as IP address) of the user loading a logo. No evidence, scope or account data. |
| Region | Brandfetch’s hosted API and logo CDN. |
| DPA | Brandfetch terms of service. |
Cloudflare, Inc.
CDN, DNS, and proxy in front of the app, the API, and garde1.com.
| Data classes | All web traffic to the app, the API, and garde1.com, in transit, including request metadata such as IP addresses. |
| Region | Global network. |
| DPA | Cloudflare Data Processing Addendum. |
New Relic, Inc.
Browser performance monitoring in the app.
| Data classes | Page load timings, errors, page URLs, and browser metadata from app sessions. |
| Region | United States. |
| DPA | New Relic Data Processing Addendum. |
Cal.com, Inc.
Demo scheduling on the marketing site.
| Data classes | Name, email, and meeting details entered when booking a demo. No data from the app. |
| Region | United States. |
| DPA | Cal.com Data Processing Agreement. |
Stripe, Inc.
Payment processing and subscription billing.
| Data classes | Billing email, subscription tier, invoice history, last-four card digits. Garde1 does not store full card numbers or CVCs. |
| Region | United States. |
| DPA | Stripe Services Agreement + DPA executed. |
Hugging Face serves the file for a small embedding model that runs in your browser. The browser downloads the model file; no customer data is sent to Hugging Face, so it is not a subprocessor.
What we don't use
For the record, Garde1's production stack does not include the following classes of subprocessor:
- Public LLM APIs (OpenAI public API, Anthropic public API, etc.). All LLM inference and embeddings run on Azure OpenAI under Garde1's Azure tenancy.
- Google Analytics in the application. Google Analytics runs on the marketing site only. The app runs the New Relic browser agent listed above.
- Generic email-marketing platforms (Mailchimp, SendGrid public list, etc.). Transactional and notification email is sent via AWS SES in us-east-2 from a Garde1-verified identity.
How to receive change notices
Subprocessor changes are posted on this page at least 30 days in advance. If you want email notifications to a compliance distribution list (not the sign-in account), use the form below with the distribution address you'd like to subscribe.
Request a DPA copy or change notices
Use the form below to request a copy of any executed subprocessor DPA or to subscribe a distribution list to change notices.