ARMOUR24-7

Legal

Sub-processors

When you use ARMOUR24-7, a small set of carefully chosen third parties process some of your data on our behalf — to run our infrastructure, deliver email, take payment, and keep our app healthy. They never receive the contents of your journal. We update this page whenever our vendor list changes.

Version
Version v1.0
Last updated
Last updated May 11, 2026

A note on what these vendors can and cannot see

Your journal entries are encrypted on your device. No sub-processor — and no ARMOUR24-7 staff member — can read them. Payment vendors see billing metadata, never your reflections. See our Privacy Policy for the full picture.

Payments

  • Stripe, Inc.

    Card payment processing and subscription billing on the web (USD, GBP, EUR).

    Data we share
    • billing email
    • card last-4 + brand (tokenized; full card numbers never reach ARMOUR24-7)
    • billing country
    • IP address (fraud check)
    Where it's processed
    • US
    • EU

  • PayMongo, Inc.

    Card and e-wallet payment processing for Philippine peso billing.

    Data we share
    • billing email
    • card last-4 + brand (tokenized)
    • IP address (fraud check)
    Where it's processed
    • PH

Mobile platform billing

  • Apple Inc.

    In-app purchase processing on iOS (StoreKit2). Apple is the merchant of record; we receive only the signed transaction metadata.

    Data we share
    • transaction ID
    • product purchased
    • storefront country
    Where it's processed
    • US
    • global (Apple data centers)

  • Google LLC

    In-app purchase processing on Android (Play Billing). Google is the merchant of record; we receive only the purchase token + acknowledgement metadata.

    Data we share
    • purchase token
    • product purchased
    • storefront country
    Where it's processed
    • US
    • global (Google data centers)

Infrastructure & hosting

  • Amazon Web Services, Inc.

    Application hosting, managed databases (RDS), object storage (S3), key management (KMS), and managed Kubernetes (EKS).

    Data we share
    • account profile data
    • encrypted journal ciphertext (the key is never sent to AWS)
    • audio file storage
    • operational logs
    Where it's processed
    • US (us-east-1)
    • EU (eu-west-1) for EU users
    • AP (ap-southeast-1) for PH users

CDN & edge security

  • Cloudflare, Inc.

    CDN, DDoS protection, WAF, and DNS. Caches static assets and audio segments at the edge; inspects requests for abuse patterns.

    Data we share
    • IP address
    • request headers
    • cached audio segments
    Where it's processed
    • global (Cloudflare PoPs)

Observability

  • Functional Software, Inc. (Sentry)

    Error tracking and Real User Monitoring (crash reports, performance traces). Source maps are uploaded; payloads are scrubbed for PII before send.

    Data we share
    • error stack traces
    • release version
    • device/browser identifiers
    • a hashed user ID (never the email or display name)
    Where it's processed
    • US

  • BetterStack (Better Stack, s.r.o.)

    Synthetic uptime monitoring and the public status page at status.armour24-7.com. Only sees the URLs probed and their HTTP responses.

    Data we share
    • endpoint URLs probed
    • response status
    • subscriber email (if user opts in)
    Where it's processed
    • EU

Communications

  • Twilio Inc. (SendGrid)

    Transactional email delivery (account verification, password reset, receipts, legal updates).

    Data we share
    • email address
    • name (if provided)
    • transactional email content
    Where it's processed
    • US

Staff identity (SSO)

  • Google LLC (Google Workspace)

    Single sign-on for ARMOUR24-7 staff into the Admin Panel. Consumer users are unaffected.

    Data we share
    • staff email
    • staff display name
    • sign-in timestamps
    Where it's processed
    • US
    • global (Google data centers)

  • Microsoft Corporation (Entra ID)

    Single sign-on for ARMOUR24-7 staff into the Admin Panel. Consumer users are unaffected.

    Data we share
    • staff email
    • staff display name
    • sign-in timestamps
    Where it's processed
    • US
    • EU
    • global (Microsoft data centers)