Legal
Sub-processors
Last updated: 11 May 2026.
Wiredepth uses the third-party services listed below to operate the product. Each one processes a specific slice of customer data on our behalf, under contract with appropriate data-protection terms (DPAs in place where required). We do not sell, rent, or trade your data with anyone, including the vendors below - they only see what they need to do their job.
If we add a sub-processor, we update this page and email customers who have requested change notifications. Email [email protected] to be added to the notification list.
Active sub-processors
Amazon Web Services (AWS)
- Role
- Cloud hosting - runs the Wiredepth web server, worker, and Postgres database.
- Location
- us-east-2 (Ohio, USA)
- Data shared
- Everything that flows through Wiredepth at the network level. Our database lives on encrypted EBS storage in this region.
- Privacy policy
- aws.amazon.com/privacy/
Cloudflare
- Role
- CDN, TLS termination, DDoS protection, Web Analytics, and Turnstile bot challenge.
- Location
- Global edge network (200+ cities)
- Data shared
- Request headers, IP addresses, user agents for every request to wiredepth.com. Aggregate analytics metrics (page views, country, device) without cookies. No request bodies.
- Privacy policy
- www.cloudflare.com/privacypolicy/
Stripe
- Role
- Payment processing for Pro / MSP / Enterprise subscriptions.
- Location
- United States (with regional data residency for EU customers)
- Data shared
- Customer name, email, billing address, card details. Card numbers never touch Wiredepth servers - tokenized by Stripe.
- Privacy policy
- stripe.com/privacy
Resend
- Role
- Transactional email delivery (magic-link sign-in, alert notifications, baseline digests).
- Location
- United States
- Data shared
- Recipient email address, sender, subject line, full email body for every email we send.
- Privacy policy
- resend.com/legal/privacy-policy
Large language model API provider
- Role
- Backing LLM for two distinct AI features: (1) AI-assisted remediation playbooks on the Domain Monitor product (Pro tier), and (2) the "Is this real?" email triage in the browser extension + Outlook add-in.
- Location
- United States
- Data shared
- Two flows, both opt-in per click: (1) For Domain Monitor "Generate AI plan", sanitized scan result JSON. No customer email, no billing data, no WHOIS. (2) For "Is this real?" email triage, the sender display name + address, subject line, visible message body text (truncated, with attachments/images/signatures stripped), and deduplicated body-link hostnames. Sent only when you click the triage button on a specific message; never sent automatically and never on messages you haven't opened. We do not retain the content after the verdict is rendered, and the vendor's API terms forbid using submitted content to train their models. Enterprise customers can opt out of the third-party model entirely via BYO API key on /account/ai - the extension and add-in then route through your own model vendor of choice. The specific vendor identity is operationally-sensitive and not named publicly. We disclose it to B2B customers under NDA on request (typical turnaround: same business day) and commit to 30-day advance notice before swapping the vendor under contractual change-notification terms.
- Privacy policy
- Contact under NDA for vendor identity
SSLMate (certspotter)
- Role
- Certificate Transparency log access for subdomain inventory and drift monitoring.
- Location
- United States
- Data shared
- Domain names we query (your monitored domains) sent to their public CT log API. No customer-identifying information attached.
- Privacy policy
- sslmate.com/privacy/
Public-data sources (not sub-processors)
For completeness: Wiredepth also queries several public databases as part of its monitoring work. These are NOT sub-processors because they do not process your data on our behalf - we make outbound queries to their public APIs:
- Public DNS resolvers for every DNS lookup
- RDAP services for domain registration data
- Certificate Transparency log providers for subdomain enumeration
- Mail blocklists (DNSBLs) for blacklist reputation. We query a curated set of high-signal lists and deliberately skip the noisier ones known to false-positive on shared cloud sender pools.
- HSTS Preload List for HSTS preload status
- Public web servers via direct HTTPS / SMTP probes for TLS, headers, and MTA-STS data
- Malware-distribution + active-threat IOC feeds for matching monitored hosts and resolved IPs against known-bad indicators
- IP-abuse confidence provider (Pro feature). We send the IPs that resolve from your monitored hosts; the provider returns a 0-100 confidence score. Daily quota guard auto-stops well within the published rate limit.
- Public CVE feedsfor matching newly- published high-severity CVEs against the technology stack we fingerprint from your monitored hosts' response headers (Server, X-Powered-By).
- Ransomware leak-site / cyberattack aggregator feeds (multiple sources, polled every 15 minutes) for matching extortion-site victim posts and public cyberattack reports against your monitored hosts and brand-watchlist keywords.
- Credential-breach corpus providerfor per-domain breach matching. We send the monitored domain's apex; the provider returns breach metadata. We deliberately discard the leaked email addresses themselves and only persist breach name + count.
These queries contain only the domain you asked us to scan - never your account email, billing details, or anything else that could identify you to those services. Specific provider names are commercial-confidential; if you require source disclosure for an audit or procurement evaluation, email [email protected] and we'll provide them under NDA.
Customer notifications
For B2B customers under contract that requires advance notice of sub-processor changes, we provide at least 30 days notice by email before adding a new sub-processor. You may object within 30 days; if we cannot resolve the objection, you may terminate your subscription with a pro-rated refund.
For customers without that contractual term (the default for Pro tier), we update this page when changes happen and announce material changes (e.g. moving regions, adding an LLM vendor) in the product changelog.
Data Processing Addendum
If your jurisdiction requires a signed Data Processing Addendum (DPA) - generally any EU/UK company under GDPR, or US healthcare / financial-services customers - email [email protected] and we will send our standard DPA for countersignature. We use the IAPP-published reference template with appropriate Standard Contractual Clauses for cross-border transfers.