Subprocessors & data residency
This table is generated from the machine-checked manifest used by our CI vendor-marker gate. It covers declared dependencies and known data flows; contract and infrastructure review remain part of adding a provider. Review by: .
| Vendor | Service | Data | Region | Transfer basis | Data terms |
|---|---|---|---|---|---|
| Cloudflare | CDN / Workers / R2 (including the isolated compile cache) / KV / DNS / TLS | content, logs, tls | EU jurisdiction (Frankfurt/Amsterdam PoPs; data-plane R2 bindings, including COMPILE_CACHE, require jurisdiction:EU) | DPA+SCC | Review terms |
| Hetzner | FSN1 Docker host for the primary PostgreSQL 16 data plane | tenant-data, audit | FSN1 (Falkenstein, Germany); PostgreSQL has no public host port | DPA | Review terms |
| Neon | Postgres manual fallback (tenant metadata and audit while retained) | tenant-data, audit | aws eu-central-1 (Frankfurt); inactive unless DATABASE_PROVIDER=neon is deliberately deployed | DPA+SCC | Review terms |
| DigitalOcean | Droplet host for compile / portal-build / ssrf-proxy / Meilisearch (behind Caddy) | content, search-index | AMS3 (Amsterdam) | DPA+SCC | Review terms |
| WorkOS (US carve-out) | Authentication / SSO / staff directory (the documented US exception) | auth-identity | AWS US | DPA+SCC/DPF | Review terms |
| Stripe (US carve-out) | Payments + Stripe Tax | billing, vat | US (+EU processing entities) | DPA+SCC/DPF | Review terms |
| Lago (self-hosted) | Usage metering & invoicing — self-hosted on the EU droplet, no vendor data flow | usage, billing | self-hosted, DigitalOcean AMS3; its own postgres-partman container, never the product primary (doc 23 amended 2026-08-04) | n/a (self-hosted OSS) | Review terms |
| Schematic (US carve-out) | Entitlement flags | plan-flags | US | DPA+SCC/DPF | Review terms |
| Meilisearch (self-hosted) | Docs search — self-hosted on the EU droplet, no vendor data flow | search-index | self-hosted, DigitalOcean AMS3 | n/a (self-hosted OSS) | Review terms |
| Tinybird | API-call analytics | api-telemetry | gcp europe-west3 (Frankfurt) | DPA | Review terms |
| PostHog EU | Product analytics, feature flags, replay, errors, logs, and metrics | product-telemetry, error-context, operational-telemetry | EU cloud (Frankfurt) | DPA | Review terms |
| Google Analytics (US carve-out) | Consent-controlled acquisition analytics for doctorine.xyz and app.doctorine.xyz | website-usage, device-metadata | Google global infrastructure; no collection before explicit analytics consent | Consent+DPA+SCC/DPF | Review terms |
| AWS Bedrock | AI inference (Ask-AI / MCP) | content | eu-central-1 (Frankfurt) — PINNED in services/portal-worker/wrangler.jsonc and apps/dashboard/wrangler.jsonc, no longer inherited from a library default. Models are the EU geo cross-region inference profiles eu.amazon.nova-lite-v1:0 / eu.amazon.nova-pro-v1:0; AWS documents that a geo-tied profile's destination Region list NEVER changes (Bedrock User Guide, 'Supported Regions and models for inference profiles', read 2026-08-06). OPEN, tracked in architecture/plans/portal-perfection/security-designs.md §4.5: the destination Region ENUMERATION for these two profiles is no longer published on that page (AWS moved it to each model's detail page / GetInferenceProfile) and has not been read, and the DEPLOYED env of both Workers has not been enumerated. Until both land, this row states the pinned configuration, not a verified end-to-end residency guarantee, and the EU-moat claim may not name AI inference (§4.4). | DPA+SCC | Review terms |
| Amazon SES | Transactional email (EmailPort adapter, swap-ready) | email-metadata | eu-central-1 (Frankfurt) | DPA+SCC | Review terms |
| Turbopuffer | Vector retrieval (Ask-AI RAG) | content-embeddings | EU | DPA | Review terms |
| Resend (US carve-out) | Transactional email (EmailPort default) | email-metadata | Sending region eu-west-1 (Ireland) — message ROUTING and delivery originate in the EU; Resend stores account data, email metadata, logs and API records in the US regardless of sending region (resend.com/docs/dashboard/domains/regions, verified 2026-07-25). Message BODIES are Doctorine-rendered transactional notices; the recipient address is the personal data at rest in the US. | DPA | Review terms |
EU data-at-rest by construction; US carve-outs are disclosed rows, never hidden (docs 04/19/34). Notice of material subprocessor changes is governed by the applicable DPA and customer contract.