Sub-processors
The third parties Distriib LLC uses to deliver the Service, what each one does, and what data it sees.
- Provider
- Distriib LLC
- Last updated
- September 30, 2026
- Contact
- support@distriib.com
The list
A sub-processor marked optional is engaged only when the Customer turns on the feature that needs it.
| Sub-processor | What it does | Data it processes | Location |
|---|---|---|---|
| Cloudflare | Object storage (R2) for security logs and, for tenants with cold storage on, for the compressed archive. Optional Logpush ingestion of Cloudflare logs. | Security logs and telemetry: IP addresses, hostnames, usernames, command lines, optional URLs, WAF and HTTP logs | Cloudflare's own infrastructure and contracting entity; current details on request |
| Railway | Hosting and compute for the Service, and the managed Postgres database holding account and configuration metadata. | User emails and bcrypt password hashes, tenant and organization data, devices, sources, rules, alerts, lists. Security logs pass through memory while the Service runs. | United States (US East) |
| Resend | Transactional and notification email: account mail such as password-reset links, usage notices at 80% and 100% of quota, alert notifications sent by email, and platform alerts to the operator. | Recipient email addresses; the subject and body of the message, which for an alert notification includes the alert title and the tenant name | Resend's own infrastructure and contracting entity; current details on request |
| GitHub *(optional)* | Detection as code: pulling detection rules from a repository. | Repository contents (the rule files); the access token, if a private repository is connected | Engaged only when a repository is connected |
The AI features are not a third party
Every AI feature runs on a model server Distriib operates itself. Nothing is sent to a third-party AI provider, and the only sub-processor involved is the hosting provider already listed above.
Exception: the Customer's own model
Since 2026-09-29 a Customer administrator can connect the Customer's own model — Anthropic, OpenAI, an OpenAI-compatible gateway, or the Customer's own server — at Settings → AI in the console, and choose which features use it. Those features then send the content described below to that provider, under the Customer's own account and agreement with it; nothing falls back to our server if it fails. That provider is chosen and contracted by the Customer, and is not a Distriib sub-processor.
What each feature sends is worth being precise about, because it is no longer only what a person types:
| Feature | What reaches the model |
|---|---|
| Assistant chat | Only what the user types into the chat box. No tenant log data is added to it. |
| AI-drafted detection rules | Only the description the user types. No log data. |
| AI case verdicts | The case (title, summary, severity, status), the alerts attached to it — titles, rule names, severities, counts, detection queries and the entities the evaluator extracted: hostnames, usernames, IP addresses — and the investigation notes analysts wrote. This is customer data derived from logs. |
| AI triage of alerts | One alert: title, rule name, severity, counts, detection query, the entities the evaluator extracted, what the platform knows about them (geolocation, matches on the Customer's own lists, the enrolled device), the rule's playbook, and how many earlier alerts of the same rule were closed as false positives. Customer data derived from logs. |
A case verdict is on demand: nothing is sent until someone asks for an analysis of a specific case. Alert triage is on demand too, unless an administrator turns on automatic triage (Settings → AI, off by default), in which case every new alert at or above the severity they choose is sent as it fires.
What was sent is recorded, with a hash of the exact text, and can be deleted on request. The model has no tools and no write access: its answer is stored and displayed, never acted on.
Changes to this list
We may add or replace a sub-processor as the Service evolves. Where a Data Processing Agreement is in place, its notice and objection terms apply. To be told when this list changes, write to us.
Contact
Questions about sub-processors, or a request for a provider's current entity, region and transfer mechanism: Distriib LLC — support@distriib.com.