Data protection
This page applies to BYOC deployments. To compare the plans, see Deployment models.
Roles
Under the Data Processing Agreement (DPA), you are the data controller and SubImage is the data processor. You decide which accounts and tools SubImage connects to, and SubImage processes that data only to provide the service.
BYOC does not change these roles. It changes where the data is stored: in a cloud account that you own and control.
Data SubImage processes
| Data | Examples |
|---|---|
| Inventory | Cloud resources, identities, permissions, code repositories, devices, and the relationships between them |
| Findings | Rule results, vulnerabilities, attack paths, and issues |
| User data | Names, email addresses, and roles of your SubImage users |
| AI conversations | Chat messages and the answers of the AI agent |
| Credentials | Tokens and keys you give SubImage to read your tools |
SubImage reads metadata and configuration through the modules you enable. Each module setup guide lists what the module reads.
Where the data is stored
| Data | BYOC | BYOC with Private Graph |
|---|---|---|
| Graph | Neo4j AuraDB, in the region of your deployment | Your account |
| Findings, settings, users, conversations | Your account | Your account |
| Files and exports | Your account | Your account |
| Credentials | Your cloud secret manager; OAuth integration credentials in the SubImage vault | Same |
| Graph backups | Neo4j AuraDB | Your account |
Some data leaves your account to reach the services listed in BYOC architecture. These are the main cases:
- Sign-in sends user identities to WorkOS.
- AI features send chat messages, and the data the agent reads to answer them, to OpenAI.
- Error reports, product analytics, metrics, and logs go to Sentry, PostHog, and Grafana Cloud.
Retention and deletion
Your data stays in your deployment while the deployment exists.
When you delete the deployment, SubImage deletes the cluster, the databases, the storage buckets, and the secrets in your account. With the BYOC plan, SubImage also deletes the Neo4j AuraDB instance. Two things stay in your account, under your control:
- A final backup of the PostgreSQL database. On AWS, the snapshot stays until you delete it. On Google Cloud, Cloud SQL deletes the final backup after 30 days.
- With BYOC with Private Graph, the graph backups. Each backup is locked for 30 days, so nobody can delete it before then, the account owner included. The bucket empties itself as the locks expire.
See Operations for the steps.
Sub-processors
The DPA lists the sub-processors under contract, with their location and purpose.