Legal · Data Processing
Sub-Processor List
Last updated: April 2026 · All legal documents
Current Sub-Processors
| Sub-Processor | Purpose | Data Location |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | Control-plane and managed-gateway infrastructure hosting — compute, storage, networking, database services — and transactional email (Amazon SES). | us-east-1 (platform control plane) and customer-selected regions for tenant gateway workloads. |
| The Constant Company, LLC (Vultr) | Gateway compute and networking for customers who select Vultr as their gateway hosting provider. AegisWire is multi-vendor by design — gateways run on AWS or Vultr with no vendor lock-in. | Customer-selected regions, engaged only when a customer provisions Vultr-hosted gateways. |
| Stripe, Inc. | Payment processing, subscription billing, and invoice management. | United States (Stripe infrastructure). Payment data is processed directly by Stripe and is not stored on AegisWire servers. |
Vultr is engaged as a sub-processor only for customers who choose Vultr-hosted gateways; tenants running exclusively on AWS-hosted gateways are not affected by it.
How Customer Traffic Is Protected
Customer traffic is carried by AWT_UNIFIED, our post-quantum transport: a hybrid ML-KEM-1024 + X25519 key exchange, ML-DSA-87 identity signatures, AES-256-GCM record encryption, and BLAKE3 STREAMHEAL integrity — aligned with the CNSA 2.0 suite. Payload contents traversing a gateway are end-to-end encrypted under per-session keys. A sub-processor that hosts a gateway provides the underlying compute and network; it does not have access to the plaintext of tunnelled customer traffic.
What We Do Not Use
AegisWire does not engage third-party analytics services, advertising networks, customer data platforms, or external AI/ML processing services that have access to customer data.
The optional AI Sentinel add-on performs entity-graph and temporal threat detection and device-posture admission. It runs inside the customer's own tenant boundary on the infrastructure listed above — it is not a separate third-party sub-processor and does not transmit customer data to any external AI provider.
Change Notification
If we engage a new sub-processor, we will update this page at least 30 days before the new sub-processor begins processing customer data. Customers with an active subscription will be notified by email at the account contact address on file. If you wish to object to a new sub-processor, please contact legal@aegiswire.com within the 30-day notice period.
Questions
For questions about our sub-processor list or data processing practices, contact legal@aegiswire.com.