Subprocessors and onward processors.

A subprocessor is a third party engaged by Guard.ch to process customer personal data on our behalf in order to deliver the service. This register identifies each such party, the role it plays, the location where the processing occurs and the legal safeguard that authorises the transfer.

This page is a public reference for the data processing relationship described in our Data Processing Addendum. Where the DPA and this register conflict on a material point, the DPA prevails for the contracting customer.

We publish updates to this register at least thirty (30) days before adding a new subprocessor that materially affects how customer data is processed, stored or transferred. Minor changes that do not affect data flow (for example a vendor's internal corporate restructure) are reflected on the next routine update without the notice period.

Customers and prospects can subscribe to written notifications by sending the word "subscribe" to privacy@guard.ch. The mailing list is used only for subprocessor and policy notices; you can unsubscribe at any time by replying with "unsubscribe".

Persistent capture storage and the production database live in a single primary region: Hetzner's Helsinki facility. Edge nodes accept browser sessions in their region and stream them over WebRTC to the end user. Edge nodes hold no persistent customer data; container scratch is wiped on session end and the underlying volumes are tmpfs-backed where the kernel allows.

Cloudflare is the authoritative DNS for guard.ch and the TLS terminator and reverse proxy for the marketing site and dashboard served at guard.ch. Backend requests from the dashboard go directly to the origin and session capture content (video and replay artefacts) is served from our Helsinki origin without traversing Cloudflare. Cloudflare Turnstile is loaded on registration, login, email-code verification, password reset and guest analysis launch forms to mitigate automated abuse.

Guard.ch supports passkeys, email-and-password sign-in and federated sign-in with Google or Microsoft. When the user chooses a federated provider, that provider receives the OAuth client identifier and returns a signed identity assertion containing the user's verified email address and basic profile fields, which Guard.ch uses to provision or look up the account. Users who only use passkeys or email sign-in do not cause any data to be sent to the providers listed below.

Stripe is the card and SEPA processor for Guard.ch. The contracting Stripe entity is determined by the customer's billing country: Stripe Payments Europe, Ltd. for customers in the EEA, Switzerland and the United Kingdom, and Stripe, Inc. for customers elsewhere. Guard.ch never holds the primary account number; the card is tokenised at Stripe and only the token, brand and last four digits are stored in our billing ledger.

Outbound transactional email (receipts, sign-in codes, security notifications, capture-ready alerts) is relayed through Google Workspace from Guard.ch mailboxes. Server-side application logs and operational metrics from the Guard.ch backend and edge agents are forwarded to Axiom for centralised search and alerting; session capture content (video and replay events) is not part of the log payloads.

Guard.ch uses third-party large language models for two narrowly scoped purposes: AI-assisted summarisation and structured extraction surfaced to users on request, and anomaly detection over server-side application logs. Session capture content is never sent to either provider as part of the operational telemetry path, and model traffic to both providers is excluded from model training by contract.

Guard.ch is operated from Switzerland. Switzerland holds an adequacy decision from the European Commission, so transfers between the EEA and Switzerland do not require additional safeguards under Chapter V GDPR.

Persistent customer data (captures, account records, billing artefacts) stays inside the EEA, specifically in Hetzner's Helsinki facility. Edge nodes outside the EEA (OVHcloud Singapore, FiberState Salt Lake City, OVHcloud Beauharnois) process session traffic ephemerally for the duration of a live session and hold no data at rest. Transfers to the US edge node and to US-based subprocessors (Cloudflare, Stripe Inc., Google LLC, Microsoft Corporation, Axiom, OpenAI) are covered by the European Commission's Standard Contractual Clauses, Module 3 (processor to processor) together with the Swiss equivalent issued by the FDPIC. Where the vendor is certified under the EU-US Data Privacy Framework (Cloudflare, Google, Microsoft, Stripe, OpenAI), the DPF is the primary mechanism and the SCCs operate as a fallback. Transfers to Beauharnois additionally rely on the European Commission's adequacy decision for the Canadian commercial sector under PIPEDA.

A transfer impact assessment for each non-EEA region is maintained internally and is available to customers on request, in line with the EDPB Recommendations 01/2020 methodology.

Customers may object to the engagement of a specific subprocessor on reasonable grounds (for example a documented incompatibility with the customer's own regulatory regime). Objections should be sent in writing to privacy@guard.ch within fourteen (14) days of the change notification.

On receipt we will work with the customer in good faith to find a workable alternative (for example pinning the affected workload to a different region, or scoping a custom processing arrangement). Where no alternative can reasonably be agreed, the customer may terminate the affected portion of the service without penalty and receive a pro-rata refund for the unused term.

Questions about this register, requests for the underlying contracts, or notifications under the change notification clause go to privacy@guard.ch. Postal mail to Zesiger.net Individual Enterprise, Mügeri 340, 5046 Schmiedrued, Switzerland.