Distributors and partners · Privacy and GDPR
Data residency, retention and sub-processors (for contracts and procurement)
What a distributor needs for a customer's data processing agreement and procurement questionnaire: where AuthGuard's shared service keeps data, for how long, which third parties take part, and which outbound connections exist. The region of a given installation is confirmed in the proposal.
Where is the data kept?
| What | Where |
|---|---|
| Identity data, sessions, audit, vault | Amazon Web Services, Ireland region (eu-west-1) |
| Backups | Ireland, with copies in Frankfurt (eu-central-1) |
| Application, database and network logs | The installation's region |
| Privileged session recordings | Object storage in the installation's region, encrypted and locked |
The infrastructure code accepts only regions in European Union member states for data, backups, logs and audit trails; the United Kingdom and Switzerland are deliberately excluded. Email sending also stays in an EU region.
For how long?
| Data | Period |
|---|---|
| Identity data | Until erased |
| Point-in-time recovery and daily backups, with their copies | 35 days |
| Application and access logs (including the IP address) | 90 days |
| Records of operator actions in the cloud account | 400 days |
| Phone-only sign-in requests | Deleted one day after they expire (each lives two minutes) |
| Single sign-on cookie digest | Erased 24 hours after the session ends |
| SAML and OIDC sign-in request contents | Emptied after 10 minutes |
| Privileged session recordings | The customer's setting, 30 days to 10 years, or legal hold |
| Suspended accounts without activity | The customer's rule (off by default) |
An erasure reaches the backups as they expire, at most 35 days later. The periods await final legal confirmation.
Sub-processors
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, key management, secrets, logs, backups | EU: Ireland, copies in Frankfurt |
| Amazon Simple Email Service | Verification and recovery emails | An EU region |
| Google (Firebase Cloud Messaging) | Waking the approver app when a request is waiting | Google service; data may go to the US under the Firebase data processing terms |
The message Google delivers to the phone has no content: no request, account, organization or code. The app fetches the request directly from the service. Google processes the phone's registration token, the installation identifier and the time of each alert.
Which outbound connections exist?
Only to host names the installation allows, and only when the matching feature is used: Google's Android attestation status list (no phone data sent), Firebase and Google's token exchange for push, Microsoft's public keys for the Entra external authentication method, Microsoft Graph for Entra directory synchronization, Let's Encrypt for custom-domain certificates, and the webhook addresses customers register. Microsoft 365 federation makes no calls to Microsoft.
What remains with the customer?
Microsoft 365, Entra ID and the customer's SAML and OIDC applications are the customer's own services, not sub-processors: they receive what the customer configures. The customer is the controller. The roles of AuthGuard and of the distributor are set in the data processing agreement, whose template is under legal review.
Was this page helpful?
Thank you. Your answer stays in this browser; nothing is sent.
Sorry about that. Try:
- searching for the exact text of the message or the error code
- the error code index
- asking your organization's administrator