Data residency & compliance
Where your data physically lives, and who can touch it, is often the first question a security review asks. Here are the plain answers.
Where your data lives
Your data is hosted in Canada, on OVHcloud infrastructure in Beauharnois, Québec: the application, its database and the agents’ traffic all run there.
Encrypted backups are kept off that host, on a separate OVHcloud server in London, United Kingdom: a nightly snapshot of the database and configuration, encrypted before it leaves Canada, with the key held apart from the backup server. Backups expire after at most 6 months.
Who processes your data
No data brokers, no ad networks. These services process part of your data on our behalf:
| Service | What it does | What it sees | Where |
|---|---|---|---|
| OVHcloud | Hosting and backup storage | Everything; backups are encrypted before they reach it | Canada (Beauharnois); backups in the United Kingdom (London) |
| Mailgun | Delivers our emails: sign-in codes, invitations, alert emails | Recipients’ addresses and the email content, which for alerts names servers and what happened | United States |
| Manifest (manifest.build) | Monitors the HTTP calls our backend makes | Those calls, including alert payloads sent to Slack and webhooks | Not stated by the provider; ask us for the current answer |
Two more come in only if you choose them: the sign-in provider you use (Google, GitHub, Microsoft, GitLab, Discord or Slack), which learns that you signed in to Demerzel, and the Slack workspace or webhook you point notifications at.
The agent’s reports themselves go to Demerzel only, over mutual TLS.
Infrastructure certifications
The underlying infrastructure is operated by OVHcloud, which publishes the certifications held by each of its data centers in its compliance documentation. Demerzel itself holds no certification.
Any such certification covers the hosting layer only. For Demerzel’s own security posture, a data-processing agreement, or a completed security questionnaire, see below.
Encryption
All traffic is encrypted in transit over HTTPS. Agents authenticate to Demerzel with a per-agent certificate (mTLS) rather than a shared key — see Access & authentication and Security & mTLS identity.
Data-processing agreement & reviews
We’re happy to sign a DPA, walk through a security questionnaire, or answer specific residency and processing questions. Contact us and we’ll take it from there — no hand-waving.