Legal · Data Processing
Sub-Processor List
Last updated: 13 October 2026 · All legal documents
Current Sub-Processors
| Sub-Processor | Purpose | Data Location |
|---|---|---|
| Microsoft Corporation Azure · Microsoft 365 |
Hosting for the AegisWire services — the website and documentation site, the customer portal, licensing and entitlements, billing and the release catalogue — comprising application compute, managed PostgreSQL, private networking, DNS and key management. Also transactional email to customer users (password reset, verification, invitations) via Azure Communication Services, and inbound business mail via Microsoft 365. This is AegisWire’s own vendor infrastructure; it is not where a Customer’s Control Plane or Gateways run. | Ireland (North Europe). The AegisWire services run in the European Union only; they are not hosted in the United States. |
| Amazon Web Services, Inc. (AWS) | Engaged as a Sub-Processor only where AegisWire operates a Customer’s deployment on the Customer’s behalf in AWS. Where the Customer runs the deployment themselves in their own AWS account, AWS is the Customer’s own provider and not an AegisWire Sub-Processor. Separately, AWS Key Management Service holds the signing keys for AegisWire release artifacts, and AWS S3 distributes those signed artifacts. Release signing and distribution involve build outputs only — no customer personal data. | Customer-selected regions for gateway workloads. Artifact signing and distribution: us-east-1. |
| The Constant Company, LLC (Vultr) | Engaged as a Sub-Processor only where AegisWire operates a Customer’s deployment on the Customer’s behalf in Vultr. Where the Customer runs the deployment themselves, Vultr is the Customer’s own provider and not an AegisWire Sub-Processor. AegisWire is multi-vendor by design — gateways run wherever the Customer chooses, with no vendor lock-in. | Customer-selected regions, engaged only where AegisWire operates a Customer’s Vultr-hosted gateways under a managed agreement. |
| Stripe, Inc. | Payment processing, subscription billing, and invoice management. | United States (Stripe infrastructure). Payment data is processed directly by Stripe and is not stored on AegisWire servers. |
| Cybot A/S Cookiebot |
Cookie-consent management on the public website. The consent banner records a visitor’s consent choice and processes the visitor’s IP address to do so. It runs on the marketing website only — never in the customer portal, the staff console, or the tunnel data path. | European Union (Denmark). |
Gateway sub-processors are engaged per customer: a tenant whose gateways run only on AWS is not affected by Vultr, and vice versa. Cybot is engaged for public-website visitors only and processes no tenant data.
Optional Website Analytics
Google Analytics provides statistics about the public marketing website only after a visitor accepts statistics cookies. It processes page views, browser and device information, and pseudonymous cookie identifiers; processing may take place outside the UK and EEA, including in the United States. This website service is separate from customer deployment processing: the tag is not installed in the customer portal, staff console, VPN Control Plane or tunnel data path. See our Privacy Policy and Cookie Policy for consent controls and details.
Website Fonts
All typefaces used on this website are served from AegisWire’s own infrastructure. The site does not load fonts or stylesheets from Google Fonts or another font CDN. Cookiebot and optional Google Analytics are described separately above.
How Customer Traffic Is Protected
Customer traffic is carried by AegisWire Transport (AWT), our post-quantum transport: a hybrid ML-KEM-1024 + X25519 key exchange, ML-DSA-87 identity signatures, AES-256-GCM record encryption, and BLAKE3 STREAMHEAL integrity — aligned with the CNSA 2.0 suite. Payload contents traversing a gateway are end-to-end encrypted under per-session keys. A sub-processor that hosts a gateway provides the underlying compute and network; it does not have access to the plaintext of tunnelled customer traffic.
What We Do Not Use
The optional public-website analytics described above does not collect customer tunnel traffic. We do not install advertising-network, customer-data-platform or external AI/ML tracking scripts in customer deployments.
The optional AI Sentinel add-on performs entity-graph and temporal threat detection and device-posture admission. It runs inside the customer's own tenant boundary on the infrastructure listed above — it is not a separate third-party sub-processor and does not transmit customer data to any external AI provider.
Change Notification
If we engage a new sub-processor, we will update this page at least 30 days before the new sub-processor begins processing customer data. Customers with an active subscription will be notified by email at the account contact address on file. If you wish to object to a new sub-processor, please contact legal@aegiswire.com within the 30-day notice period.
Questions
For questions about our sub-processor list or data processing practices, contact legal@aegiswire.com.