The substrate table, residency matrix, and subprocessor list below are the canonical answer an enterprise buyer is looking for on /security. The scanned-investigation workspace below sits behind them — both surfaces are reachable from the tabs above.
Armalo separates the public edge, control plane, execution plane, and durable storage. The canonical production decision is Hetzner first, E2B second, Cloudflare in front.
| Substrate | Component | Data type | Region | Compliance posture | Legal-review status |
|---|---|---|---|---|---|
| Hetzner dedicated AX102Pending legal review | Control plane: identity, tenancy, RBAC, billing, audit, secrets brokerage, policy, room-log services | Account metadata, organization and workspace metadata, authoritative room events, policy records, metering records | US primary: Hetzner us-west | ISO 27001:2022, GDPR Art. 28 DPA | Pending |
| Hetzner dedicated AX162Pending legal review | Primary compute pool for tenant workloads and platform workers | Ephemeral execution state, checked-out code, build cache, mission artifacts awaiting promotion | US primary: Hetzner us-west | ISO 27001:2022, GDPR Art. 28 DPA | Pending |
| E2B hosted | Secondary Firecracker-class sandbox execution behind `sandbox-substrate-e2b` | Ephemeral filesystem, checked-out repository, mission input, command output, generated artifacts | EU and US, selected by tenant policy and availability | SOC 2 Type II, HIPAA posture, GDPR DPA | Reviewed |
| Cloudflare | Public edge, TLS termination, proxying, traffic filtering, DNS | IP address, request metadata, TLS session metadata, cached public responses where configured | Cloudflare global network | Covered by Cloudflare contractual and data-processing terms | Reviewed |
| Hetzner Object StoragePending legal review | Durable object storage for approved artifacts, backups, cold audit exports, image and snapshot blobs | Encrypted objects and object metadata | US-West | ISO 27001:2022, GDPR Art. 28 DPA | Pending |
Durable control-plane data and disposable execution state live in different places and have different deletion paths. Backups follow the same residency as their primary store.
| Data class | Where stored | Default retention | Who can access | Deletion path |
|---|---|---|---|---|
| Workspace conversation log | Authoritative event log on the Hetzner control plane; encrypted backups in Hetzner Object Storage | Active for the life of the workspace; 30-day deletion window after an accepted deletion request; backups roll for 30 days | Workspace members according to RBAC; scoped Armalo operators for support or incident response; tenant-scoped agents receive only mission context | Delete workspace or submit an erasure request; live records enter deletion workflow; backup copies expire through the 30-day rolling cycle |
| User-uploaded files | Encrypted Hetzner Object Storage; temporary mission copies inside the selected tenant sandbox | Active for the life of the workspace; 30 days after deletion request; temporary sandbox copies expire when the sandbox is destroyed | Workspace members according to RBAC; mission agents only when the file is granted to that mission; scoped operators during support or incident response | Delete the file or workspace; revoke mission capability; purge live object; backup copy expires within 30 days |
| Generated code artifacts | Workspace repository and encrypted Hetzner object storage; temporary build output in the sandbox | Active while attached to the workspace or repository; 30 days after workspace deletion; sandbox output lasts only until promotion or sandbox teardown | Workspace members; connected repository provider; mission agents with repository capability; scoped operators during support | Delete from the repository and workspace artifact store; destroy sandbox; request workspace erasure; backups expire within 30 days |
| Integration credentials | Encrypted control-plane secrets vault; agents receive only short-lived capability handles | Long-lived credential remains until revoked, rotated, integration disconnected, or workspace deleted; short-lived mission credential expires at its configured deadline | Authorized Owner or Admin for connection management; credential broker for issuance; the agent does not receive the raw long-lived value | Disconnect integration, revoke at provider, rotate secret, or delete workspace; outstanding short-lived grants are revoked or allowed to expire |
| Audit logs | Append-only tenant audit store on Hetzner; Enterprise exports may be copied to the customer's destination | 90 days by default; Enterprise override available | Owner and Admin by default; authorized security Viewer where configured; scoped Armalo security and incident-response operators | Automatic expiry at 90 days; tenant deletion workflow; Enterprise export retention is controlled by the customer |
| Billing data | Armalo control plane for usage ledger and account linkage; Stripe for payment processing and regulated payment records | Usage ledger retained while the account is active and as needed for accounting, tax, dispute, and legal obligations; payment-card data remains with Stripe | Owner and billing Admin; Armalo billing operators; Stripe for payment processing | Close account and request deletion; Armalo removes data not subject to legal retention; Stripe follows its contractual and legal deletion obligations |
| Telemetry | OpenTelemetry pipeline and encrypted Hetzner stores; provider-side infrastructure telemetry where applicable | Identifiable operational telemetry follows the 90-day audit window unless needed for an active incident; aggregated anonymized metrics may be retained indefinitely | Scoped Armalo engineering, reliability, and security operators; tenant administrators for tenant-visible views | Expiry by retention job; account deletion removes tenant-linked records; aggregated anonymized metrics cannot be re-associated with a tenant |
Residency controls
A provider receives only the data needed for its purpose. This list is current as of 2026-07-22; it may evolve as Armalo adds regions, integrations, model routes, and delivery providers. Notice is provided through the DPA or customer agreement where required.
| Subprocessor | Purpose | Data shared | Region | DPA status | Legal-review status |
|---|---|---|---|---|---|
| Cloudflare | Edge proxy, TLS termination, traffic filtering, DNS | IP address, request metadata, TLS metadata, public response data, DNS query metadata | Global edge | DPA available; transfer terms governed by Cloudflare agreement | Reviewed |
| HetznerPending legal review | Dedicated compute, control plane, private networking, durable object storage, backups | Encrypted customer data, account and workspace metadata, room events, artifacts, audit records, operational telemetry | United States (Hetzner us-west) | GDPR Art. 28 DPA; ISO 27001:2022 | Pending |
| E2B | Firecracker-class sandbox execution | Mission prompt subset, selected files, repository checkout, command input and output, temporary artifacts, short-lived capabilities | EU or US, selected by policy | GDPR DPA; SOC 2 Type II; HIPAA posture | Reviewed |
| Stripe | Subscription billing, invoices, payment processing | Customer name, billing contact, plan, invoice data, payment method data handled by Stripe, transaction status | Stripe service regions, including US processing | Stripe DPA available; payment data governed by Stripe terms | Reviewed |
| OpenAI | Metered model inference when selected | Prompt and context required for the model request; generated response; request metadata | Provider-selected region or customer-contracted region | Provider DPA applies to platform inference; BYO-key customers also rely on their provider agreement | Reviewed |
| Anthropic | Metered model inference when selected | Prompt and context required for the model request; generated response; request metadata | Provider-selected region or customer-contracted region | Provider DPA applies to platform inference; BYO-key customers also rely on their provider agreement | Reviewed |
| Metered model inference when Gemini is selected | Prompt and context required for the model request; generated response; request metadata | Provider-selected region or customer-contracted region | Provider DPA applies to platform inference; BYO-key customers also rely on their provider agreement | Reviewed | |
| xAI | Metered model inference when selected | Prompt and context required for the model request; generated response; request metadata | Provider-selected region or customer-contracted region | Provider contractual data terms apply; availability and DPA terms are reviewed per Enterprise schedule | Reviewed |
| Google Workspace | OAuth identity and organization sign-in | Email address, display name, account identifier, OAuth claims, organization-domain metadata | Google global service | Google Workspace or Google API data terms apply; customer agreement may govern BYO identity | Reviewed |
| GitHub | Repository connection, checkout, branch and pull-request sync | Repository metadata, selected source code, commit data, installation identity, scoped repository token | GitHub service regions | GitHub DPA available; customer may connect its own organization agreement | Reviewed |
| SendGrid | Transactional email when configured | Recipient email, template variables, delivery metadata, bounce and complaint events | Provider service regions, commonly US/global | DPA available when SendGrid is the configured sender | Reviewed |
| Mailgun | Transactional email when configured | Recipient email, template variables, delivery metadata, bounce and complaint events | Provider-selected US or EU region where configured | DPA available when Mailgun is the configured sender | Reviewed |
Security command center
Point Armalo at a repository, name the attacker paths that matter, and get a pinned investigation you can review. Every conclusion stays attached to a source snapshot and a clear authority boundary.
Scans pin the target, preserve detector evidence, and keep suspected candidates separate from validated findings.
Connect a public GitHub repository or an approved private connection.
Security scans do not write code, merge changes, or open pull requests.
Each run records an immutable revision and scanner evidence references.
Give the investigation a target and a useful question. The first pass is designed to be safe, legible, and reviewable.
TARGET
Repository + ref
Pin what was actually examined.
MODEL
Threat priorities
Focus on consequence, not noise.
RECEIPT
Evidence trail
Trace every finding to proof.
Only this workspace’s authenticated runs appear here.