Subprocessors.
These are the third-party infrastructure providers Alovia uses to run the service. Each one receives only the narrow slice of data it needs to do its job, and is bound by terms that bar it from using that data for its own purposes. This list is referenced by our Data Processing Addendum and our Privacy Policy.
Who operates Alovia
Alovia is a service operated by its founder, Chanpreet Singh, based in San Francisco, California, United States. No incorporated entity is claimed. A street address is available on request. Alovia is currently an invite-only free beta, serving customers and visitors in the United States, with a specific focus on California.
Current subprocessors
| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Railway | Application hosting, primary Postgres database, Redis, and background queues. | Account records, security findings and verdicts, Shield traffic records, short-lived session and job state, rate-limit counters. | United States |
| DigitalOcean | Edge servers that run the Shield protection in front of protected websites. | Visitor traffic to protected sites in transit (IP address, headers, path, timing) and short-lived verification state. | United States |
| Anthropic | AI model evaluation for Watchdog verdicts and requested code security scans. | The borderline agent messages submitted for evaluation and portions of code selected for scanning, under API terms that bar training on customer data. | United States |
| Resend | Transactional email delivery. | Recipient email address and message contents (verification, alerts, notices). | United States |
| PostHog | Product analytics. | Aggregated pageviews and feature-usage events, tied to an account only after sign-in. US cloud region. | United States |
Shield visitor data and Watchdog agent data
When Alovia runs Shield, its website-protection service, it processes a customer's visitor traffic metadata (IP addresses, request headers, request paths, timestamps) on the customer's behalf. Shield visitor data is retained for 90 days. When Alovia runs Watchdog, its agent-protection service, it processes the messages a customer's AI agents receive; message excerpts and evaluation rationales are cleared after 30 days. Alovia does not sell either kind of data, and does not use it to train generative AI. The subprocessors above may hold this data only to store it, host the service, evaluate it as described, or run the queues that process it.
Changes and contact
All subprocessors listed here are based in the United States. Alovia gives notice of material changes to this list, so a customer has a reasonable opportunity to object on data-protection grounds.
To ask a question about this list, or to object to a subprocessor, email privacy@aloviaai.com.