Last updated 9 October 2026.
1. Reading this register
The AWS shared-hosting profile places product databases, customer-content storage and regional backups in India. Global edge delivery and service metadata, edge logs kept in the USA for 14 days before their India copy, diagnostics, sign-in location and onward email delivery may involve other countries. A storage location is not a promise that all processing remains there. Customer-operated deployments use the customer's chosen infrastructure; remote support or an enabled service can create a separate processing path.
This edition describes the AWS hosting profile that Code Security and FDIE have run on since 5 October 2026. Existing signed orders and processing terms continue until validly changed. Confirm the profile for your organisation before relying on a location, retention period or recovery objective.
Dodo Payments acts as merchant of record and an independent controller for the sale. Business contact providers can support Magdox's own controller activities. Neither category is automatically a processor of uploaded code findings or firmware under a customer DPA.
2. Hosting and delivery
| Provider | Product / purpose | Processing location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting for both products: compute, FDIE analysis, sign-in, databases, storage, backups and secrets. | India (Mumbai) |
| Amazon Web Services (CloudFront and edge security) | Content delivery, TLS and web application firewall for both products. | Global edge network; edge logs kept in the USA for 14 days, then in India for 180 days |
| Cloudflare, Inc. | DNS, bot checks on website forms, the magdox.io website, which holds a website form briefly when MAGDOX CRM cannot be reached, and the network in front of MAGDOX CRM's public address (crm.magdox.io), which carries the CRM's email links and forms and the messages the products and the website send to it. Product traffic does not pass through Cloudflare. | Global network |
3. Application and business services
| Provider | Product / purpose and role | Processing location |
|---|---|---|
| Amazon Web Services (Amazon SES) | Transactional, security and invitation email for both products, and email from MAGDOX CRM: confirmations, opted-in newsletters, onboarding and support replies. | India (Mumbai; MAGDOX CRM's newsletters and campaigns from Hyderabad); recipients' mail systems may be elsewhere |
| Oracle Corporation (Oracle Cloud Infrastructure) | Hosting for MAGDOX CRM: enquiries, sign-up, billing and support records. No source code or firmware. | India (Mumbai) |
| Zoho Corporation (Zoho Mail, Zoho Forms and Zoho Books) | Email for our @magdox.io addresses, including privacy, grievance, security and support correspondence; the optional feedback survey linked from the last onboarding email; and our accounting records, including invoices for customers we bill directly. | India (Zoho's India data centre) |
| Cal.com, Inc. | Scheduling meetings with prospects and customers. | USA |
| Zoom Video Communications, Inc. | Meetings with prospects and customers; recorded only with notice and consent. | USA |
4. Diagnostics, analytics and sign-in location
| Provider | Product / purpose | Processing location |
|---|---|---|
| Sentry (Functional Software, Inc.) | Filtered error diagnostics for both products and the website, and performance diagnostics for the Code Security dashboard and FDIE. No session replay or request bodies. | USA |
| PostHog, Inc. | Optional usage analytics for the website, the Code Security dashboard and FDIE, only with consent; FDIE's events reach PostHog through FDIE's own relay, without your IP address. No recordings, form contents, source code or firmware. | USA |
| IPinfo Inc. | FDIE sign-in location for the organisation audit log; receives the IP address. | USA |
5. Independent payment provider
| Provider | Purpose / role | Processing location |
|---|---|---|
| Dodo Payments | Merchant of record for online subscriptions; an independent controller, not a subprocessor. Card details go to Dodo, never to Magdox. | Per Dodo Payments' privacy notice |
6. Customer-chosen services
Identity providers, repository hosts, webhook destinations, customer cloud storage and AI providers chosen by the customer are governed by its own configuration and agreements. They are not automatically Magdox subprocessors. Public package registries and release hosts receive ordinary installation/download traffic, not customer source code from Magdox. Review their terms before enabling a connection.
7. Public vulnerability databases
To match vulnerabilities, hosted FDIE looks up the names and versions of libraries it finds in firmware in OSV.dev, the public vulnerability database Google operates. A lookup carries only the package name and version, never firmware, file contents or account details, and Google answers it as a public service, not as a Magdox subprocessor. A customer-operated FDIE makes these lookups only where its operator enables them. The vulnerability data Code Security's CLI uses is built by Magdox and downloaded from the platform; scans send nothing to these databases.
8. Changes and objections
Magdox gives at least 14 days' advance notice of a new customer-data subprocessor by updating this register and emailing affected customers' designated contacts. Send a reasoned data-protection objection to privacy@magdox.io within that period. We will work on an appropriate alternative or mitigation; if unresolved, the customer may terminate the affected service as provided in the DPA.
Listing a provider is not evidence that a particular customer's required transfer assessment, SCCs, UK Addendum or other safeguard has been completed. Complete applicable instruments before the transfer.