Sub-processors
Every third party that receives customer data, what we send each one, and what we deliberately never send.
Last updated: 6 August 2026
The providers, and what each receives
This list is generated from the register our own backend holds, so it cannot drift away from the software. Each entry names the source files the claim was checked against. The same register is served as JSON at /api/privacy/disclosure if you would rather read it that way.
Groq, Inc.
Optional
LLM inference for incident root-cause analysis, and for the Nivaran in-product chat assistant.
LLM analysis is entitlement-gated and falls back to deterministic rules-based analysis; the rules engine remains the source of truth.
What we send
Incident context: monitor type, status codes, response times, timestamps and incident timeline.
The affected asset's domain name (deliberately retained -- an analysis that cannot name the host is not actionable).
Monitor error messages, truncated to 500 characters and scrubbed of credential-shaped substrings.
For the chat assistant: the message text the user types.
What we never send
Organization UUID, incident/asset/monitor primary keys -- dropped by sanitize_for_llm before the prompt is built.
Account email addresses, names, or payment data.
Data processing agreement
Not documented
Data residency
Not documented
Transfer safeguard
Not documented
Verified against our own source code:
app/core/intelligence/context/redaction.py (sanitize_for_llm)app/core/intelligence/prompts/incident_rca_prompt.pyapp/providers/groq.py
Google LLC (Gemini API)
Optional
Fallback LLM inference for incident root-cause analysis.
Invoked only when the primary provider fails.
What we send
Identical payload to Groq -- both providers are called through build_incident_rca_prompt, so the same redaction applies.
What we never send
Organization UUID and row primary keys (dropped by sanitize_for_llm).
Data processing agreement
Not documented
Data residency
Not documented
Transfer safeguard
Not documented
Verified against our own source code:
app/core/intelligence/providers/gemini_provider.pyapp/core/intelligence/providers/fallback_provider.py
Resend
Required to run the service
Transactional email delivery.
What we send
Recipient email address.
Email subject and body, which may include asset domain names, incident summaries and the recipient's first name.
What we never send
Passwords or payment data.
Data processing agreement
Not documented
Data residency
Not documented
Transfer safeguard
Not documented
Verified against our own source code:
app/email/resend_provider.pyapp/services/email_service.py
Where the data goes
Nivaronix is operated from Nepal, and every provider above is headquartered in the United States or the United Kingdom. If you are in the EEA or the UK, your data therefore leaves your region — first to us, then to them.
Nepal has no European Commission adequacy decision and no UK adequacy regulations, so a transfer here relies on one of the safeguards in Chapter V of the GDPR rather than on adequacy. We have not yet put those safeguards in place, and the “Transfer safeguard” row above reads Not documented for every provider because that is the truth of it today.
We would rather say that plainly than publish a safeguard we cannot produce on request. If your organisation needs Standard Contractual Clauses or an International Data Transfer Agreement in place before it can use Nivaronix, write to [email protected] and say so — it tells us to prioritise it.
Claims we can prove
These are the statements in our privacy documentation that are easiest to get wrong over time, so each one is recorded next to the code that makes it true.
IP addresses of scan requesters are stored only as a salted one-way SHA-256 hash, never in plaintext.
app/scanner/audit.py: _hash() applies sha256 over a salt read from the environment, and the module refuses to start in production with the shared default salt.
Tenant identifiers are removed from incident data before it is sent to an LLM sub-processor.
app/core/intelligence/context/redaction.py drops organization_id and row primary keys; applied at the single prompt-building chokepoint every provider goes through.
The asset domain name IS sent to LLM sub-processors, by design.
app/core/intelligence/context/redaction.py module docstring states the domain is deliberately kept. This must be disclosed rather than glossed as 'anonymised analysis'.
Scan audit logs and security event logs expire on a retention schedule.
app/legal/retention.py: SCAN_AUDIT_RETENTION_DAYS (90) and SECURITY_EVENT_RETENTION_DAYS (180), both env-tunable. NOTE: a scheduled job that actually enforces these was not located; see PRIVACY-OWNER-DECISIONS.md.
Changes, and how to ask
When we add or replace a provider, this page changes with the code that adds it. We have not yet committed to a fixed advance-notice period before a new sub-processor starts processing — if you need one written into a contract, ask.
Questions about any provider here, or a request for a data processing agreement, go to [email protected]. How each provider fits into the wider picture is set out in our Privacy Policy.
Our other policies