Trust center
Everything a buyer, a DPO or a CISO should be able to check without writing to us: where your data is, who processes it for us, the contract that governs it, how to report a flaw, and whether the service is working right now.
Hosting in the European Union
OVHcloud (OVH SAS): OVHcloud data centres in the Paris region (France, European Union). Scope: Application, database, search engine, backups and mail server.
Emails (alerts, digests, service messages) are sent from our own mail server, hosted in the same place: no email delivery provider is involved.
The Vigie assistant calls Mistral AI, which processes data in the European Union.
Flows outside the European Union, flagged explicitly:
- Cloudflare, Inc. (United States): EU–US Data Privacy Framework (under appeal before the CJEU) with standard contractual clauses as fallback.
- PostHog, Inc. (US company; data hosted in the EU (Frankfurt)): Data processing agreement (DPA) and standard contractual clauses.
- Paddle (Paddle.com Market Limited) (United Kingdom): European Commission adequacy decision for the United Kingdom, or standard contractual clauses.
Sub-processors
The full list of providers that process personal data on our behalf. Any addition or replacement is announced at least 30 days before it takes effect, here and by email to subscribers: you can object before that date.
| Sub-processor | Role | Data concerned | Country | Transfer safeguards | Since |
|---|---|---|---|---|---|
| OVHcloud (OVH SAS) | Hosting of the servers, the database and the mail server | All service data: accounts, inventories, alerts, cases, logs, emails sent | France | Not applicable: hosted in France | 2026-09-23 |
| Cloudflare, Inc. | Reverse proxy, page delivery (CDN) and attack protection in front of the website and the application | IP addresses, headers and content of the requests passing through | United States | EU–US Data Privacy Framework (under appeal before the CJEU) with standard contractual clauses as fallback | 2026-09-23 |
| PostHog, Inc. | Audience measurement for the website and the application | Page views, clicks, technical browser information, IP address; only with your consent: persistent identifier, session recording (inputs masked), account identity | US company; data hosted in the EU (Frankfurt) | Data processing agreement (DPA) and standard contractual clauses | 2026-09-23 |
| Mistral AI | “Vigie” assistant and AI features | Messages sent to the assistant and the useful technical context (components, alerts, CVEs, end of life), only when you use these features | France; hosted in the EU | Not applicable: processed in the European Union | 2026-09-23 |
| Paddle (Paddle.com Market Limited) | Merchant of Record: payment, invoicing and taxes for subscriptions | Name, email, billing address, VAT number, payment method (entered at Paddle, never with us) | United Kingdom | European Commission adequacy decision for the United Kingdom, or standard contractual clauses | 2026-09-23 |
Change history
- Version 1, published on 2026-10-18, effective 2026-10-18: Publication of the sub-processor register and opening of change notifications. List unchanged since 23 September 2026: OVHcloud, Cloudflare, PostHog, Mistral AI, Paddle.
Get notified of changes
Receive an email each time the list of sub-processors changes, with its effective date and how to object. A confirmation email is sent first: without your click, nothing else is sent. One-click unsubscribe in every message.
Check your inbox
If the address is valid, a confirmation email has just been sent. Follow its link to complete the subscription.
Data processing agreement (DPA)
Our data processing agreement under Article 28 GDPR, with the description of the processing, the security measures and the list of sub-processors as annexes, can be downloaded without a request or a form.
Template — legally reviewed version to come
The published document is a template: it has not yet been legally reviewed or signed by the publisher. The signed version will replace it at the same address.
Coordinated vulnerability disclosure
Think you have found a flaw in TechWatchAlert? Write to [email protected]. We acknowledge every report, keep you informed until it is fixed and agree the publication date with you; no legal action against anyone acting in good faith within the rules.
Service status
The status page publishes the real state of the application, vulnerability monitoring and alert delivery, with the history of the last 30 days.