Subprocessors & data residency
This table is generated from the machine-checked manifest used by our CI vendor-marker gate. It covers declared dependencies and known data flows; contract and infrastructure review remain part of adding a provider. Review by: .
| Vendor | Service | Data | Region | Transfer basis | Data terms |
|---|---|---|---|---|---|
| Cloudflare | CDN / Workers / R2 (including the isolated compile cache) / KV / DNS / TLS | content, logs, tls | EU jurisdiction (Frankfurt/Amsterdam PoPs; data-plane R2 bindings, including COMPILE_CACHE, require jurisdiction:EU) | DPA+SCC | Review terms |
| Hetzner | FSN1 Docker host for the primary PostgreSQL 16 data plane | tenant-data, audit | FSN1 (Falkenstein, Germany); PostgreSQL has no public host port | DPA | Review terms |
| Neon | Postgres manual fallback (tenant metadata and audit while retained) | tenant-data, audit | aws eu-central-1 (Frankfurt); inactive unless DATABASE_PROVIDER=neon is deliberately deployed | DPA+SCC | Review terms |
| DigitalOcean | Droplet host for compile / portal-build / ssrf-proxy / Meilisearch (behind Caddy) | content, search-index | AMS3 (Amsterdam) | DPA+SCC | Review terms |
| WorkOS (US carve-out) | Authentication / SSO / staff directory (the documented US exception) | auth-identity | AWS US | DPA+SCC/DPF | Review terms |
| Stripe (US carve-out) | Payments + Stripe Tax | billing, vat | US (+EU processing entities) | DPA+SCC/DPF | Review terms |
| Lago Cloud EU | Usage metering & invoicing | usage, billing | EU (Frankfurt) | DPA | Review terms |
| Schematic (US carve-out) | Entitlement flags | plan-flags | US | DPA+SCC/DPF | Review terms |
| Meilisearch (self-hosted) | Docs search — self-hosted on the EU droplet, no vendor data flow | search-index | self-hosted, DigitalOcean AMS3 | n/a (self-hosted OSS) | Review terms |
| Tinybird | API-call analytics | api-telemetry | gcp europe-west3 (Frankfurt) | DPA | Review terms |
| PostHog EU | Product analytics & flags | product-telemetry | EU cloud (Frankfurt) | DPA | Review terms |
| Google Analytics (US carve-out) | Consent-controlled acquisition analytics for doctorine.xyz and app.doctorine.xyz | website-usage, device-metadata | Google global infrastructure; no collection before explicit analytics consent | Consent+DPA+SCC/DPF | Review terms |
| AWS Bedrock | AI inference (Ask-AI / MCP) | content | eu-central-1 (Frankfurt) | DPA+SCC | Review terms |
| Amazon SES | Transactional email (EmailPort adapter, swap-ready) | email-metadata | eu-central-1 (Frankfurt) | DPA+SCC | Review terms |
| Sentry | Error tracking (EU data residency) | error-context | EU region (Frankfurt) | DPA | Review terms |
| Turbopuffer | Vector retrieval (Ask-AI RAG) | content-embeddings | EU | DPA | Review terms |
| Resend (US carve-out) | Transactional email (EmailPort default) | email-metadata | Sending region eu-west-1 (Ireland) — message ROUTING and delivery originate in the EU; Resend stores account data, email metadata, logs and API records in the US regardless of sending region (resend.com/docs/dashboard/domains/regions, verified 2026-07-25). Message BODIES are Doctorine-rendered transactional notices; the recipient address is the personal data at rest in the US. | DPA | Review terms |
EU data-at-rest by construction; US carve-outs are disclosed rows, never hidden (docs 04/19/34). Notice of material subprocessor changes is governed by the applicable DPA and customer contract.