Subprocessors
Effective 27 October 2026
A subprocessor is a company outside Kandaro that handles personal data for us, so that we can run the service. This page lists every one of them: who they are, what they do for us, which data they receive, where they process it and how a transfer outside the European Economic Area is protected.
Kandaro has two roles. For the data we hold about our own customers and visitors (accounts, billing, support, website visits) we are the controller, as described in our Privacy policy. For the data your organisation puts into Kandaro (sensor events, SOC signals, cases and response actions) we are your processor, under our Data processing agreement. Each entry below says which of the two it concerns.
Our subprocessors
Cloudflare
- Entity
- Cloudflare, Inc.
- What for
- Network edge in front of Kandaro: domain name service, encrypted connections, protection against attacks and abuse, the secure tunnel to our servers, staff access control, and the bot check on our public forms and sign-in pages.
- Data
- All traffic between browsers, sensors and Kandaro passes through it, including account details, sensor events and SOC data. For the bot check: the visitor’s IP address and technical browser signals.
- Where
- United States, with a global network that serves each visitor from a nearby data centre
- Transfer safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
- Your data under the DPA
- Yes
Resend
- Entity
- Plus Five Five, Inc. (Resend)
- What for
- Sending email from Kandaro (account and security emails, invitations, alerts, billing and status notices, reports and support replies) and receiving email sent to our support address.
- Data
- Names and email addresses of recipients and senders, and the content of each email. Alert emails can include incident details, such as the address that touched a decoy and the summary of what happened.
- Where
- United States
- Transfer safeguard
- Standard Contractual Clauses
- Your data under the DPA
- Yes
Sentry
- Entity
- Functional Software, Inc.
- What for
- Error monitoring, so we can find and fix faults in the website, the Console and our back end.
- Data
- Technical error reports: what went wrong and where in our code, the page or API path without its query, and the browser type. Reports are stripped of names, email addresses, cookies, form contents and IP addresses before they leave our servers. Browser reports go through Kandaro’s own servers first, so Sentry never sees a visitor’s IP address.
- Where
- European Union (Germany), in Sentry’s EU data region
- Transfer safeguard
- Standard Contractual Clauses, for support access by Functional Software, Inc. from the United States
- Your data under the DPA
- Yes
Stripe
- Entity
- Stripe Payments Europe, Limited
- What for
- Subscriptions, checkout, invoices, tax calculation and the billing portal.
- Data
- Organisation name, billing contact and email address, billing address, VAT or tax number, payment method and payment history, and a cancellation reason if one is given. Card details go straight to Stripe and never reach Kandaro. For payment processing and fraud prevention Stripe also acts as an independent controller.
- Where
- Ireland, with processing by Stripe, Inc. in the United States
- Transfer safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
- When
- When an organisation subscribes to a paid plan or is invoiced
- Your data under the DPA
- No, Kandaro’s own data as controller
Google Tag Manager, Analytics and Ads
- Entity
- Google Ireland Limited
- What for
- Tag Manager loads the cookie banner and other tags on our website. Analytics measures visits and Ads measures which of our ads work.
- Data
- Tag Manager: IP address and technical browser data on each page load. Analytics and Ads: cookie identifiers, pages visited and interactions.
- Where
- Ireland, with processing by Google LLC in the United States
- Transfer safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
- When
- Website visitors only, never the Console. Analytics and Ads run only after the visitor accepts those cookies
- Your data under the DPA
- No, Kandaro’s own data as controller
CookieYes
- Entity
- CookieYes Limited
- What for
- The cookie banner on our website, and the record of each visitor’s choice.
- Data
- The consent choice with its date and a random consent identifier, the IP address and technical browser data.
- Where
- United Kingdom
- Transfer safeguard
- EU adequacy decision for the United Kingdom
- When
- Website visitors only, never the Console
- Your data under the DPA
- No, Kandaro’s own data as controller
Sign-in provider you choose (GitHub, Google or Microsoft)
- Entity
- GitHub, Inc.; Google Ireland Limited; Microsoft Ireland Operations Limited
- What for
- Signing in to the Console with an existing account at that provider.
- Data
- The provider confirms who you are and sends Kandaro your account identifier and email address. It learns that you signed in to Kandaro.
- Where
- United States (GitHub); Ireland, with processing in the United States (Google, Microsoft)
- Transfer safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
- When
- Only if a user chooses to sign in with that provider. Password sign-in uses none of them
- Your data under the DPA
- No, Kandaro’s own data as controller
Tools your organisation connects to Kandaro SOC or uses to receive alerts (for example your EDR, identity provider, firewall, SIEM, ticketing, chat or paging tool) are not our subprocessors: they are your own suppliers, and Kandaro reads from or sends to them only on your instruction.
How we choose and bind them
Before a supplier receives personal data, we check what data it needs, why and where it will process it, and how it protects that data, including its security certifications, access controls and track record. We send each supplier only the data it needs for its task.
Every subprocessor is bound by a written contract that meets Article 28 of the GDPR. It may use the data only to provide its service to us, must keep it confidential and secure, must help us meet the rights of the people concerned, must tell us about a breach without delay and must delete or return the data when the service ends. Where data leaves the European Economic Area, the contract also includes the safeguard shown for that subprocessor, and we assess whether the transfer is adequately protected. We stay responsible to you for the work of our subprocessors.
Changes to this list
We tell the admins of every customer organisation at least 30 days before we add or replace a subprocessor that will handle customer data, by email, and we update this page at the same time. The notice names the subprocessor, what it will do and where.
If you have a reasonable objection based on data protection, you may object within that notice period, as set out in the Data processing agreement. We will then work with you on a solution, such as not using the new subprocessor for your data. If we cannot find one, you may end the affected part of the service as the DPA describes.
Changes that concern only Kandaro’s own data as controller, such as our website tools, are announced on this page and in our Privacy policy.
Services that receive no personal data
For completeness, these services are part of how Kandaro works but receive no personal data:
- Advisories research. When we use outside services such as DeepSeek or TinyFish to research security news and vulnerabilities, they receive only public text, such as product names and published advisories. Never a customer’s name, data, keywords or the software you told us you use.
- Public vulnerability databases. We look up public vulnerability information without sending anything that identifies you.
- Breached-password check (Have I Been Pwned). When you choose a password, we send only a short fragment of a one-way fingerprint of it. The service cannot learn the password or who you are.
- Location and network data (DB-IP). We download the database and look up addresses on our own servers. No lookup leaves Kandaro.
- Sensor image (GitLab). The sensor software is published on GitLab’s registry. Your servers download it directly; Kandaro sends GitLab no data about you.
- AI. The AI that explains incidents and supports investigations runs on Kandaro’s own hardware. Event, incident, SOC and support data is never sent to an outside AI provider.
Hosting
Kandaro does not use a cloud hosting provider. We run our own servers in the Netherlands, and that is where your data and our encrypted backups are stored. Traffic reaches our servers through Cloudflare’s network, listed above; our servers accept no other connections from the internet. If we ever move hosting to a provider, that provider will be a subprocessor and we will give notice as described above.
Questions
For questions about our subprocessors or to receive notices of changes, contact us.