Subprocessors
Who processes customer data on Moatgator's behalf, for what, which data and in which country. We give 30 days' notice before adding or replacing a subprocessor.
Last updated:
Draft under legal review. This text is not binding yet and may change.
This is a courtesy translation; the Portuguese version prevails.
This is the list of third parties that process personal data so that Moatgator (GZ Segurança e Defesa Cibernética LTDA, CNPJ 40.988.106/0001-60) can provide the service. It is part of the Data Processing Agreement (DPA), section 7, and of the Privacy Notice.
How to read the list
- In use: already processes customer data today.
- Planned: vendor chosen, not connected yet. Nothing is sent to it until it is "In use".
- Evaluating: options still under study; no data is sent.
- Condition: some vendors only receive data when the customer or the person turns on a feature (for example, sign-in with Google or AI investigation).
Change notices
Before a subprocessor starts processing customer data, or before we replace one, we update this page and notify organizations by e-mail and in the console at least 30 days in advance. The customer may object within that period, as set out in the DPA (section 7.3).
International transfers
Today all platform data is processed in the United States, on Railway (California), including data of organizations that picked the Brazil or European Union region at sign-up: separate infrastructure per region does not exist yet. The US has no adequacy decision from Brazil's data protection authority (ANPD), so transfers use the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024), as described in the DPA (section 8 and Annex III). Customers can ask for a copy of the clauses in force with any subprocessor.
Current list
| Function | Provider | Data | Region | Status |
|---|---|---|---|---|
| Cloud hosting and database (API, console, workers, PostgreSQL) | Railway | All platform data: accounts, Telemetry, Attest verdicts, audit trail, billing records | United States (California) | In use |
| File storage (S3-compatible bucket) for Scan packages and build artifacts | Railway (Buckets) | App packages sent for analysis (deleted within 24 hours) and protected builds | United States | In use |
| Transactional e-mail (verification, security, alerts, billing) | Resend | Recipient address and message content | United States | In use |
| DNS for moatgator.com | Amazon Web Services (Route 53) | No customer data: only DNS queries for our domains | Global | In use |
| Code hosting and integrations: sign-in with GitHub, GitHub App (Solve pull requests), CI identity (OIDC) | GitHub (Microsoft)Only for users and organizations that connect GitHub | GitHub account id, e-mail and organizations; content of the repositories the customer authorizes | United States | In use |
| Android integrity verification (Attest) | Google (Play Integrity API)Only for apps whose customer configures Android Attest, using the customer's own Google Cloud service account | The encrypted integrity token generated on the device | Global | In use |
| Optional sign-in with Google or X | Google, X Corp.Only when the person chooses that sign-in method | Account identifier and verified e-mail returned by the provider | United States | In use |
| Payments and invoicing (card and Pix) | Stripe | Billing contact, tax ID and payment details (card data stays with the provider) | Brazil and United States | Planned |
| Error monitoring | Sentry | Technical error details; IP addresses and e-mails are scrubbed before sending | United States | Planned |
| AI investigation in the console and docs assistant | AnthropicConsole: only for organizations that opt in. Docs: only the question typed by the visitor | Aggregated or pseudonymized excerpts of Telemetry, with no device hash, IP or e-mail; docs questions with IPs and e-mails removed | United States | Planned |
| Encrypted off-site backups | Cloudflare R2 or Backblaze B2 (to be chosen) | Database dumps encrypted before upload (the provider cannot read them) | To be defined | Evaluating |
| Bot protection on public forms (optional) | Cloudflare Turnstile | Browser signals needed to tell people from bots | Global | Evaluating |
DNS (Route 53) is listed for transparency: it does not receive customer data. Sign-in providers (Google, GitHub, X) receive the sign-in request directly from the person and also act as independent controllers of the account the person holds with them.