Subprocessors

1. Vercel Inc.

• Role: Website hosting and content delivery.
• Purpose: Serves this marketing site and runs the serverless access-request endpoint.
• Data it can receive: Request metadata (IP address, user agent, timestamps) and the access-request form content while the message is delivered.
• Processing location: United States, with edge delivery from regional points of presence.
• Contract status: no signed data-processing agreement is currently in place for this provider. We use the provider’s standard terms. Before a customer requires a signed DPA, ask us for the current position and we will provide it in writing.

2. Cloudflare, Inc.

• Role: Bot and abuse protection (Turnstile); optional backup object storage (R2).
• Purpose: Verifies that an access request comes from a real browser instead of an automated script, and stores backup copies where R2 is used.
• Data it can receive: Turnstile signals and challenge results; backup copies of service data where R2 is used. Turnstile is cookie-less and is not used for advertising or cross-site tracking.
• Processing location: United States, with a global network.
• Contract status: no signed data-processing agreement is currently in place for this provider. We use the provider’s standard terms. Before a customer requires a signed DPA, ask us for the current position and we will provide it in writing.

3. Google (Google Workspace)

• Role: Business email.
• Purpose: Receives and stores correspondence sent to our published addresses, including access requests forwarded from the site.
• Data it can receive: Email content, sender and recipient addresses, and message metadata.
• Processing location: United States and European Union regions used by Google Workspace.
• Contract status: no signed data-processing agreement is currently in place for this provider. We use the provider’s standard terms. Before a customer requires a signed DPA, ask us for the current position and we will provide it in writing.

4. Hosted Workbench deployment infrastructure

Vercel serves this marketing site, Cloudflare protects the access-request form, and Google Workspace carries our email. None of them receives assessment content from a customer workspace.

The compute, storage, database, queue, object-storage, and backup providers that run a customer’s hosted Workbench deployment are named in the order package and the Data Processing Addendum for that deployment, together with the hosting region. The current deployment is stated to run compute and Redis on Oracle infrastructure in Frankfurt. PostgreSQL runs on a separate service whose provider is not yet confirmed. The rclone backup target is Cloudflare R2 in the EU. Encrypted PostgreSQL dumps are also written to Google Drive in the EU, and backup encryption keys are held in Azure Key Vault in the EU. Those providers must be named in the Data Processing Addendum before customer data is processed. That list is provided at procurement rather than published here, because it can differ by region and by plan. Ask us for the current list for the region you need and we will provide it in writing before you sign.

Out-of-band callback service: to confirm issues that only show up when a target calls back, an assessment can send blind-callback payloads to an out-of-band callback endpoint. Unless a dedicated endpoint is configured for the deployment, this uses the public interactsh network operated by ProjectDiscovery. What that network can observe is limited to the callback itself: the source address the callback came from, the unique correlation token, the protocol, and the time. The mapping from a token to your target, parameter, and finding stays in your workspace, and the token alone does not identify you or the target.

Assessment egress: scans also make ordinary outbound requests to the targets you authorized. Those targets are chosen by you and are not subprocessors.

5. Hosted Workbench AI processing (where enabled)

• Model gateway: the hosted Workbench can route model requests through api.eresussec.com. The gateway applies server-side model and limit policy, but it does not redact prompt content before forwarding it upstream.
• Upstream model providers: selected per deployment and named in the order package before AI processing is enabled. The current route is a mix of an aggregator and direct provider endpoints; model families in use are stated to include GLM, Claude/Opus, and GPT variants. This public page does not assert a provider, region, zero-data-retention term, no-training term, or fixed provider-side retention period that has not been contractually confirmed.
• Payload: model requests can include assessment prompts, tool schemas, and model output needed for agent-assisted triage. Assessment inputs can contain personal data or secrets, so credentials should be scoped and rotated for the engagement. The provider has given an oral no-training assurance, but no written no-training, zero-retention, or region commitment has been supplied; do not treat the oral assurance as a contractual term.
• Customer control: AI-assisted analysis is used only where the deployment enables it. A customer that does not enable it does not send assessment content through this path.

6. Change notification

• We add a subprocessor only when it is needed to operate the service, and only after a security and data-protection review.
• We publish a change to this page before the new subprocessor starts processing customer data.
• A customer that objects to a new subprocessor on reasonable data-protection grounds can raise the objection in writing and we will work to resolve it, including offering a configuration that avoids the processor where one exists.

7. Appendix: also processed for our own operations

• Accounting and invoicing tooling for contract and tax records, under professional confidentiality.
• Version control and continuous-integration services, used for our own source code and releases, not for customer assessment content.
• These systems hold business records rather than customer findings. A customer that needs them named for a security review can request the full inventory from the contact below.

8. Contact

Questions about a subprocessor, a data-residency requirement, or a transfer mechanism: contact@eresussec.com.