Service register · Draft for vendor review
Subprocessors and external services
This is the planned hosted-alpha register. “Planned” does not mean configured or legally approved, and disabled providers receive no service data. The reviewed status and transfer details must be updated before production approval.
| Provider | Status | Purpose | Information |
|---|---|---|---|
| Supabase | Planned | EU-hosted database, authentication, and private file storage | Customer and account data in the selected EU project region |
| Vercel | Planned | Application hosting and scheduled worker invocation | HTTP requests, application output, and operational metadata |
| Resend | Planned | Transactional email delivery | Recipient email, generic event text, and delivery metadata |
| Mapbox | Disabled | Optional geographic map tiles | Public institution coordinates and request metadata only |
| PostHog or other analytics | Disabled | Optional content-free product analytics | Allowlisted event categories and count ranges only |
| External AI provider | Disabled | Optional reviewed public-source assistance | Only explicitly authorized institution-owned public sources |
Before production, record legal entity, service location, DPA date, transfer mechanism, retention, and security-review owner for each enabled provider in the operational register.