Subprocessors
Version 0 ยท Draft, not yet in effect
Draft: this document is incomplete and not in effect.
Service providers that process data for this application.
| Provider | Service | Data | Location |
|---|---|---|---|
| Cloudflare | Application hosting (Workers) and request logs (Workers Logs) | Every request to the application. Logs keep each request's path (query string removed), status and outcome, and redacted error messages; Issues group errors with their stack traces | Cloudflare's network; the application runs near the database in AWS us-east-1 |
| Cloudflare | Database connection (Hyperdrive, caching disabled) | Database queries and results pass through; nothing is cached | Not recorded in the ADRs |
| Cloudflare | Bot protection (Turnstile) on sign-up, sign-in, password reset and verification email | The Turnstile token and the visitor's IP address, sent for verification | Not recorded in the ADRs |
| Cloudflare | Transactional email (Email Service) | Recipient's email address and message content (verification, password reset, invitation) | Not recorded in the ADRs |
| Cloudflare | Database backups (R2) | A daily full copy of the database, deleted after 30 days | Automatic (chosen by R2) |
| Neon | Primary database (PostgreSQL) | All account and organization data | AWS us-east-1 |
| Polar Software, Inc. | Billing, as merchant of record (sandbox mode; no real payments yet) | Organization id and name; billing managers' user ids and email addresses; the IP address of whoever starts a checkout; what the buyer enters in Polar's checkout | Not recorded in the ADRs |
| GitHub | Database backup job (GitHub Actions) | The daily database dump passes through the job on its way to R2 | Not recorded in the ADRs |
| Slack | Production error alerts (from Cloudflare Workers Issues, to a private channel) | Alerts on new and returning production errors: the error message and stack trace, which may be unredacted and include the request's path, the issue's id, type, status and occurrence count, and possibly diagnostic context such as request metadata or log lines | Not recorded in the ADRs |
Placeholder (owner/lawyer text required): How changes to this list are announced.