Subprocessors and data flow

Current infrastructure baseline

• Application hosting: DigitalOcean droplet infrastructure for the first production deployment.
• Container registry and CI/CD: GitHub and GitHub Actions.
• Package distribution: npm for the public JavaScript SDK.
• Email delivery: Resend for authentication and operational product email.
• Payments/billing: Stripe is the intended billing provider when paid plans are enabled.

Data categories by flow

• Public website: request metadata, registration details, and contact/support requests.
• Backoffice console: users, roles, tenant settings, API key metadata, webhook config, and support/audit events.
• Cloud API: webhook metadata, idempotency records, dedupe keys, queued jobs, and delivery status.
• Email provider: recipient address, template type, delivery status, and provider message id.
• Billing provider: customer, subscription, invoice, payment status, and external provider references when billing is enabled.

Not yet enabled by default

Broad analytics, marketing pixels, session replay, and third-party product analytics are not part of the first production baseline. If those tools are added later, the cookie notice, privacy notice, and this inventory must be updated before they are enabled.

Customer review

Customers that require a formal subprocessor notice period, DPA exhibit, region restriction, or vendor security review should handle that through the written agreement before sending regulated or production-critical traffic.