# Subprocessors

This page lists the third-party service providers that Virusis engages as subprocessors to deliver parts of its scanning and platform services.

This list is maintained in accordance with the [Data Processing Notes](/legal/data-processing-agreement.md) and is updated when subprocessor relationships change.

## Scan engines

These subprocessors handle file hash and metadata processing as part of file, hash, and URL scanning services.

| Subprocessor                           | Service                | Location    | Data processed                            | Safeguard                          |
| -------------------------------------- | ---------------------- | ----------- | ----------------------------------------- | ---------------------------------- |
| **VirusTotal** (Google LLC)            | File and hash scanning | US          | File hashes (SHA-256, MD5), file metadata | Standard Contractual Clauses (SCC) |
| **Hybrid Analysis** (CrowdStrike Inc.) | File and hash scanning | US          | File hashes, file metadata                | Standard Contractual Clauses (SCC) |
| **Jotti** (Jotti's Malware Scan)       | File scanning          | Netherlands | File content (temporary), file metadata   | EU Adequacy — EU/EEA country       |

> File content is not permanently stored after scanning. Only file hashes and scan results are retained.

## Infrastructure services

| Subprocessor      | Service                        | Location | Data processed             | Safeguard |
| ----------------- | ------------------------------ | -------- | -------------------------- | --------- |
| *To be confirmed* | Server hosting                 | *TBD*    | All platform data          | *TBD*     |
| *To be confirmed* | CDN (Content Delivery Network) | *TBD*    | Static content, IP address | *TBD*     |
| *To be confirmed* | Email delivery                 | *TBD*    | Email address, name        | *TBD*     |

## Security services

| Subprocessor                           | Service                  | Location | Data processed                            | Safeguard                          |
| -------------------------------------- | ------------------------ | -------- | ----------------------------------------- | ---------------------------------- |
| **hCaptcha** (Intuition Machines Inc.) | Bot protection (CAPTCHA) | US       | IP address, device info, interaction data | Standard Contractual Clauses (SCC) |
| **Cloudflare** (optional)              | WAF / DDoS protection    | US/EU    | IP address, HTTP headers                  | Standard Contractual Clauses (SCC) |

## Analytics services

| Subprocessor                      | Service       | Location | Data processed                           | Safeguard                   |
| --------------------------------- | ------------- | -------- | ---------------------------------------- | --------------------------- |
| **Google Analytics** (Google LLC) | Web analytics | US       | Anonymous visitor identifier, usage data | SCC + anonymized processing |

> Analytics services are subject to user consent. Preferences can be managed from the [Cookie Preferences](/legal/cookie-preferences.md) page.

## Change notification

Before adding new subprocessors, enterprise customers are notified at least 30 days in advance. Customers may object in writing within 15 days with a reasonable justification.

To subscribe to subprocessor change notifications, contact <info@virusis.com> with the subject line "Subprocessor Notification."


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.virusis.com/legal/subprocessors.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.