# Subprocessors and other recipients of customer data

**Draft, 2026-10-21. For counsel; not a contractual list.** `docs/data-rights-audit.md`
recorded that this list did not exist and that an enterprise or federal security
review will ask for it. Everything below was read from the code and the vendors'
project settings on the date above. Where a fact could not be checked from here, the
row says so instead of guessing. Whether a data processing agreement is in place
with each vendor is **not recorded here** and needs to be confirmed.

"Customer data" here means data about or supplied by an account: identity, billing,
monitored areas, portfolio locations, incidents and their files, and email
addresses. Public event and historical data is not customer data.

## Subprocessors (vendors that store or process customer data for Calchis)

| Vendor | What it receives | Where | How it is reached | Checked |
|---|---|---|---|---|
| Supabase | The database (every account, area, portfolio, incident and log row), auth users, incident file storage | AWS `us-east-1` | `lib/supabase/server.ts`, `lib/supabase/client.ts` | project region read from the Supabase API |
| Vercel | The application, its functions and request logs (which carry IP addresses), the runtime cache (`lib/cache.ts`: cached API responses and API-key tier lookups, no account content), Vercel Web Analytics page views | Functions in Vercel's default region: `vercel.json` pins none | `app/layout.tsx` (`@vercel/analytics`), every route | no `regions` key in `vercel.json` |
| Stripe | Billing identity, subscriptions, payment method (entered on Stripe's hosted page; card data never reaches Calchis) | Stripe | `app/api/v1/checkout/route.ts`, `app/api/webhooks/stripe/route.ts` | — |
| Resend | Outbound email: recipient addresses and message contents (alerts, digests, invitations, sign-in links) | not checked from here | `lib/email/mailer.ts`; delivery webhooks verified with Svix (`app/api/webhooks/resend/route.ts`, a library, not a recipient) | region **unverified** |
| Sentry | Error events and 10% of performance traces, with the SDK's default PII setting (`sendDefaultPii` not enabled) | not checked from here (the DSN host says US or EU) | `sentry.*.config.ts`, `instrumentation.ts` | region **unverified** |
| Mapbox | Map tile requests and the text of addresses typed into the search box, sent from the user's browser with its IP address; Mapbox's own telemetry (`events.mapbox.com`) | Mapbox | `mapbox-gl`, the geocoder in the header search | Mapbox geocodes are displayed only, never stored (`tests/lib/stored-coordinates-do-not-come-from-mapbox.test.ts`, data-rights F1) |

## Other recipients (public services the server sends customer-supplied inputs to)

Not contracted processors, but a reviewer will ask what leaves the platform.

| Service | What it receives | Why |
|---|---|---|
| US Census Geocoder (`geocoding.geo.census.gov`) | The address text of monitored areas and portfolio locations | The only geocode Calchis stores (`lib/geocode-for-storage.ts`) |
| USGS 3DEP Elevation Point Query Service | Latitude and longitude of scored points | Ground elevation (`lib/geo/elevation.ts`) |
| FEMA National Flood Hazard Layer, NOAA VDatum | Latitude and longitude of scored points | Flood zone, base flood elevation, datum conversion (`lib/geo/nfhl.ts`, `lib/geo/vdatum.ts`) |
| US Census TIGERweb | Area names and points | Boundaries for monitored areas (`lib/geo/resolve-area.ts`) |

They receive coordinates or an address, never an account identifier.

## Former

| Vendor | Until | What it held |
|---|---|---|
| Upstash (Redis) | 2026-10-21 | Cache entries, per-minute rate-limit counters, daily API quota counters, API-key tier lookups. Removed in #795; `UPSTASH_*` environment variables still to be deleted from Vercel. **The privacy policy still names Upstash** and is legal copy, left for counsel. |

## To confirm before this is published

1. A DPA with each subprocessor, and its date.
2. The Resend and Sentry regions.
3. Whether Vercel Web Analytics needs naming in the privacy policy as configured.
4. The privacy policy's subprocessor wording against this list.