Trust, hosting & sub-processors
Relvato runs its compute in the European Union and stores its database in the United States. This page states where your data is processed and stored, and lists the third-party services (sub-processors) we rely on.
Last updated 4 October 2026.
Where your data is hosted
Relvato's application and API — including the Real-user Web Vitals (RUM) ingest endpoint — run on Vercel in the European Union (Frankfurt, region fra1). The background worker that runs the monitors is hosted on Railway in the EU (Amsterdam). The primary database is Neon PostgreSQL in the United States (AWS us-east-2, Ohio), where run results and aggregated RUM measurements are stored, and encryption keys are managed with AWS KMS (us-east-1). In short: your data is processed in the EU and stored in the US, so a transfer to the United States applies.
Real-user Web Vitals (RUM) data
The RUM beacon measures anonymous Core Web Vitals timings (LCP, INP, CLS, plus FCP and TTFB) from real page loads. It is cookieless and stores no personal data — no names, no user identifiers, and no IP addresses (a visitor's IP is used only transiently, in memory, for rate-limiting, and is never written to storage). Measurements are aggregated by coarse page type (for example home or product) and device (mobile/desktop) into percentiles — never per individual visitor. This data is received by Vercel in the EU (Frankfurt) and stored in Neon in the US (AWS us-east-2, Ohio).
Quarantine mode data
When you put a WordPress site in quarantine, the Relvato plugin reports what changes on it for the length of the quarantine: file paths with their sizes and modification dates (never file contents), WordPress usernames and roles, an administrator's email domain (never the full address), the names of scheduled tasks, and the values of a few settings such as the site address. It is kept with the site's quarantine log in Neon in the US (AWS us-east-2, Ohio) and deleted when the site is removed.
Outside services map
If you turn on Outside services in the Relvato WordPress plugin (version 1.50.0 and later; off until you do), the plugin records which outside services each of your plugins and themes contacts from your server: the plugin's or theme's folder name and the host name it called — never the full address, what was sent or what came back — with the day each was first and last seen. Relvato's Exposure scan reads the list to tell you when a plugin starts contacting a new service. The list is kept in your site's own database; the copy Relvato keeps between scans is stored with the run in Neon in the US (AWS us-east-2, Ohio). Switching it off in the plugin deletes the list from your site.
Google Search Console and Bing Webmaster Tools data
If you connect Google Search Console or Bing Webmaster Tools to a site, Relvato reads that site's search data with the read-only access you grant through Google's or Microsoft's own sign-in. We keep an encrypted refresh token (AWS KMS) and daily totals only: clicks, impressions and average position by search type, device and country, the number of pages that appeared in results, Bing's pages-in-index and crawl-error counts, and sitemap addresses with their URL and error counts. Each run also names the pages and search queries that lost the most ground (at most the 50 most-searched of each), kept only with the run for as long as your plan keeps run history, and up to 50 of your pages are checked with Google's URL Inspection tool, their latest results kept until you disconnect. The data is stored in Neon in the US (AWS us-east-2, Ohio), kept for 16 months, used only to show you your own site's numbers and alert you about them, and deleted when you disconnect. Google and Microsoft are the sources of this data at your direction, not sub-processors. With the Signs of a hack monitor on, Relvato also reads the site's most frequent search queries and pages (up to 1,000 of each, over the last week) to look for spam a hack added, and keeps only the ones that look like spam, inside that run's results. Relvato's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sub-processors
Relvato uses the following third-party services to provide the product. Each is bound by its own data-processing terms.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Application & API hosting (incl. the RUM vitals endpoint) | European Union — Frankfurt (fra1) |
| Neon | Primary database (PostgreSQL) — where run results and RUM data are stored | United States — AWS us-east-2 (Ohio) |
| Amazon Web Services (KMS) | Encryption key management for stored secrets | United States — us-east-1 |
| Cloudflare (R2, Turnstile) | Object storage for run screenshots/artifacts; spam protection on website forms (Turnstile) | Global edge (automatic) |
| Railway | Background worker that runs the monitors | European Union — Amsterdam |
| Clerk | Account authentication | United States |
| Polar | Billing & payments (merchant of record) | United States / EU |
| Anthropic | AI assistance for optional fix suggestions | United States |
| Resend | Transactional email — alert emails, client reports, status page updates to their subscribers, and website form messages (contact, waitlist) | United States (stored data) / EU — sent from Ireland (eu-west-1) |
| Google Analytics | Website analytics for the marketing site (consent-gated cookies) | United States / Global |
| Google Cloud (Web Risk) | Signs of a hack monitor: whether a monitored site’s pages are on Google’s list of unsafe sites. Only the public page addresses are sent | United States / Global |
| Sentry | Error monitoring — errors in Relvato's own servers (the app and the monitor worker); no visitor tracking | European Union — Frankfurt |
How Relvato's bot identifies itself
Every request Relvato's monitoring bot makes to a customer's site is signed with Ed25519 HTTP Message Signatures (Web Bot Auth), so a firewall can verify it really came from us rather than trusting a user agent. Our published setup — key directory, signatures and agent card — is graded by WebBotAuth.net, an independent checker.
What the bot is and how to allow or block it →
Questions
For data-processing questions or a DPA, contact us at contact@relvato.com.