Praefic
Continuous Azure security posture management: Praefic scans your Azure estate, scores its posture, and assigns an owner and a remediation initiative to every finding, so issues get owned and cleared, not just listed.
Data residency and data protection
#Praefic is hosted on Microsoft Azure in the EU, and customer data is stored and processed in the EU only, including AI processing by Mistral with zero data retention. Other data residency boundaries are not currently offered for Praefic.
Plain-language search over findings uses AI and is always on. AI-generated management-report summaries and remediation suggestions are off by default and run only after a customer administrator turns them on. Before any data is sent to Mistral, Praefic removes the names, user principal names, e-mail addresses and IP addresses of people from it.
Subprocessors
#| Subprocessor | Processing region | Parent jurisdiction | Relationship | DPA |
|---|---|---|---|---|
| Herodesk | EU (Germany) | Denmark | Direct | On file |
| Support ticketing for all products and all residency boundaries: support requests and the contact details of the customer staff who submit them. Support data is deleted or irreversibly anonymised 365 days after the ticket is closed.Data: Support request content; Contact details of customer staff submitting requests | ||||
| Mistral AI SAS | EU | France | Direct | On file |
| AI processing for product features. Which features use Mistral, their defaults and the data sent are described for each product. Zero data retention applies to inputs and outputs, and submitted data is not used for model training.Data: Product data submitted to AI features; as described for each product | ||||
| Railsware Products Studio LLC (Mailtrap) | United States | United States | Direct | Not held |
| Delivery of transactional and notification e-mail sent by our products, for tenants whose primary region is in the United States or Canada. Delivery logs are kept for 15 days and message bodies for 7 days.Data: Recipient e-mail addresses; Message content; Delivery metadata | ||||
| Scaleway SAS | European Union (France) | France | Direct | On file |
| Delivery of transactional and notification e-mail sent by our products, for tenants whose primary region is in the EU/EEA. The service is operated entirely within the EU, and no personal data is transferred outside the EU. E-mail data is kept for up to 7 days.Data: Recipient e-mail addresses; Message content; Delivery metadata | ||||
Processing region: where the subprocessor processes the data. Parent jurisdiction: the country whose law governs the subprocessor's parent company. Relationship: Direct when we contract with the subprocessor, Sub-subprocessor when it is reached through another processor. DPA: whether a data processing agreement with it is on file.
Availability and continuity
#Praefic has a 99.5% availability target, covering continuous posture scanning, scoring, finding ownership and reporting.
| Plane | Monthly target | Why |
|---|---|---|
| Posture scanning, scoring and reporting | 99.5% | Covers the service as a whole. During an outage, new findings are not detected and the dashboard and reports are unavailable until the service recovers. Your Azure resources themselves are not affected. |