Legal
Subprocessors
The third-party providers that process personal data for MCP Guard, what each one receives, and where.
Last updated ·
1. Providers that can receive request content
These providers can process the content of API requests, which we handle as your processor under the Data Processing Agreement.
| Provider | Purpose | Data | Location | When |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Hosting of the website, dashboard, API and MCP gateway (Workers), DNS, TLS, DDoS protection, rate limiting, the encrypted tunnel to our Swiss GPU servers, and the usage-metering queue. | All traffic in transit, including request content (passed through, not stored); IP addresses and technical logs (kept a few days); usage metadata while it is queued for billing. | Cloudflare’s global network (the data centre nearest the caller) | Always |
2. Providers for account, billing and email
These providers process account and billing data, for which we are the controller (see the Privacy Policy).
| Provider | Purpose | Data | Location | When |
|---|---|---|---|---|
| Supabase, Inc. (USA), on Amazon Web Services | Authentication and the account database. | Account data, sign-in records (including IP address), hashed API keys, credit balances and ledger, request metadata (no request content, no verdicts) and usage totals. | Switzerland (AWS Zurich region, eu-central-2) | Always |
| Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland) | Payments, subscriptions, invoices and tax calculation. Stripe also acts as an independent controller for payment processing and fraud prevention. | Name, email, billing address, tax ID, payment details (entered directly with Stripe) and purchase history. | United States, EU and other Stripe locations | When you buy credits or subscribe |
| Resend (Plus Five Five, Inc., USA) | Delivery of transactional email (sign-in and account emails). | Email address and email content. | Sending from the EU (Ireland); Resend is a US company | When we email you |
If you choose to sign in with Google, Google (Google LLC, USA / Google Ireland Ltd.) receives the fact that you signed in and shares your name, email address and account identifier with us. Google acts as an independent controller for this, not as our subprocessor.
3. Safeguards
Each provider is bound by data processing terms. Transfers to countries without an adequacy decision rely on the EU-U.S. / Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses with the adaptations required for Swiss law.
4. Failover inference
No failover inference provider is active today. If we enable one (a cloud GPU provider used when our Swiss servers are unavailable), we will add it to this page, with its data-centre locations, and give the notice below before it receives any request content.
5. Changes and notifications
We update this page and the date above whenever the list changes, and email workspace owners at least 30 days before a new subprocessor starts receiving customer content. To object to a change, email support@mcp-guard.ai; see §6 of the DPA.