Draft pending owner and legal-counsel approvalNot yet effective
Subprocessors
A candidate register of technical providers; it does not assert that any provider is live or production-verified.
This is a technically complete surface for approved content, but the current text is an operational draft, not legal advice. Do not use it for public paid sales until entity details are completed and formally approved.
01
Listing rule
A provider belongs in the approved register only when it is actually configured in production and its contract, processing location, retention and purpose are documented.
02
Code integrations — not activation claims
- Supabase / PostgreSQL: authentication and database, when a production project is configured.
- Cloudflare R2: private evidence storage, when a private bucket is configured and verified.
- Paddle: Merchant of Record and payments, after live verification and webhook proof.
- Resend: email delivery, after domain, sender and webhook verification.
- Cloudflare Turnstile: abuse protection, after keys and hostnames are verified.
03
Optional AI
No AI provider is a declared subprocessor until actually enabled and its data scope, retention and consent are approved. Deterministic rules and original evidence are never changed by an assisted explanation.