Subprocessors
Last updated: 27 September 2026
This page lists the third parties that Techmek LLC uses to run the Hosted Service (the console at vguard.techmek.io) and that may process personal data for our customers. It forms part of our Data Processing Addendum (DPA).
1. Current subprocessors
| Subprocessor | Service | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Contabo GmbH and its affiliate Contabo Inc. | Virtual server hosting the console (one Kubernetes node, PostgreSQL database) | All Customer Data held by the Hosted Service (see DPA Annex 1), at rest and in memory. Secrets are encrypted at rest. | United States (St. Louis, Missouri data centre) | EU and UK: Standard Contractual Clauses (with UK Addendum) where data is transferred from the EEA/UK |
| Amazon Web Services, Inc. | Off-site storage of database backups (Amazon S3, region us-east-1) | Database backups, encrypted to our offline key before upload. AWS holds ciphertext only and cannot read it. | United States (Northern Virginia) | As above |
2. Service providers that do not process Customer Data
| Provider | Service | Data |
|---|---|---|
| Internet Security Research Group (Let's Encrypt) | TLS certificates | Our host names only; no customer personal data |
3. Not our subprocessors
- Your AI providers (for example Anthropic, OpenAI). Your gateways send requests to them directly, with tokens in place of protected values. You contract with them; they are your processors or service providers, not ours.
- Your identity provider (if you connect single sign-on or SCIM). You choose and control it.
- Your webhook and SIEM endpoints. They receive what you configure the console to send.
- Self-hosted and air-gapped consoles use no subprocessor of ours.
4. Not used today
We do not currently use a payment processor, an email delivery provider, a customer-support platform, or website analytics. Invoicing is manual. If we add any provider that processes Customer Data (for example a payment processor or an email delivery service), it will be listed here first under section 5.
5. Changes
We will give at least 30 days' notice before a new subprocessor processes Customer Data, by updating this page and notifying customers who have subscribed to updates (email devopsplus11@gmail.com to subscribe) or who have signed an Order Form. You may object on reasonable data-protection grounds as described in the DPA.