Data sovereignty: where your certificate data actually lives
Every certificate chain, negotiated TLS version, and cipher suite SSL Monitor records is a small piece of your infrastructure's fingerprint — which certificate authority you use, how you handle renewal, which subdomains exist at all. That inventory has real competitive and operational value, and it has to live somewhere under some country's law.
What SSL Monitor actually records
Each check connects to your server, walks the certificate chain (subject, issuer, validity window, the full chain to root), records the TLS protocol version and cipher suite the server negotiated, and checks response headers like Strict-Transport-Security. None of this is "personal data" in the GDPR sense the way a DMARC report's per-sending-IP data is — but a certificate Subject field routinely carries your organisation's legal name and location, and the accumulated audit history (which hostnames you monitor, how your TLS posture has changed over time, when certificates were issued and by whom) is a detailed map of your public-facing infrastructure that a competitor, or an attacker doing reconnaissance, would find genuinely useful.
That is the sensitivity this page is actually about: not "who received this email," but "who controls the database holding a structured inventory of your entire external attack surface."
Where that inventory lives, for us
Database and authentication: self-hosted Supabase (Postgres + GoTrue) on Scaleway infrastructure in Paris, France. Payments: Mollie, a Dutch payment service provider. Outbound email: Scaleway Transactional Email, a French provider. Inbound DMARC report email: AhaSend, a Dutch provider. DNS and CDN: Bunny.net, based in Slovenia (DNS.services remains the domain registrar only — it does not manage DNS records). Every sub-processor with access to your certificate/hostname inventory is headquartered in the EU, processing data in the EU, under EU law.
The full list of sub-processors, with what each one processes and where, is in our Privacy Policy at /privacy.
Why the company's country matters, not just the server's
Choosing "EU region" hosting from a US-headquartered company does not remove US jurisdiction over the data sitting in that region. The US CLOUD Act (2018) lets US law enforcement compel a US company to produce data it controls, regardless of where that data is physically stored — for an infrastructure inventory like the one described above, that is a genuinely different risk profile than a US company simply not existing in the chain at all. This is a well-documented tension between GDPR and US law, not a claim about any particular competitor's specific practices.
SSL Monitor's answer is the same as the rest of the MonitorBase family: none of our sub-processors are US companies, so there is no US legal entity in the chain for a CLOUD Act request to reach.
Full sub-processor register, retention windows, and account-deletion mechanics: see our privacy policy.