| Owner | Jonny Allum |
| Version | 1.0 · Effective 13/07/2026 · Review annually (July) and before any new subprocessor |
| Applies to | All vendors in the service path, and the subprocessor register below |
1. Subprocessor register (customer-facing)
This is the authoritative list of parties that may process tenant personal data. It changes only by deliberate decision, recorded here first.
| Vendor | Purpose | Data touched | Region / transfer basis |
|---|---|---|---|
| Supabase | Database, auth, RLS | All tenant workspace data | Project region (UK/EU pinned); provider DPA |
| Google Cloud | The production VM | Data in transit through the app | VM region (UK/EU); provider DPA |
| Stripe | Platform billing + tenant customer payments | Billing contacts, payment tokens (no PANs held by BizOS) | Stripe DPA + SCC/UK addendum |
| Resend | Outbound email (digests, invoices, chases, alerts) | Recipient names/emails, message content | Provider DPA + SCC/UK addendum |
| Anthropic | JonnyAI model backend | Compact structured signals (POL-05 §3) — no row dumps; not used for training | Provider DPA + SCC/UK addendum |
| Twilio (where enabled) | SMS/WhatsApp outreach (K-series) | Recipient phone numbers, message content | Provider DPA + SCC/UK addendum |
Adding a vendor to this table requires: a real need, a DPA reviewed, MFA on the account, the key stored per SOP-09, and — for anything touching tenant data — notice to tenants per the DPA's subprocessor-change clause.
2. Non-processor vendors
Registrar/DNS, GitHub (source code — no tenant data), analytics (must be cookie-light and anonymised), Capacitor/app stores. Same account hygiene, lighter review.
3. Selection and exit rules
- No sole hostage. Every store is pluggable behind one contract (local/Supabase today); data must always be exportable in a usable format. A vendor whose exit would strand data fails selection.
- Fail-open where customers would be hurt, fail-closed where money or security would leak: billing enforcement fails open (a Stripe outage never locks a paying tenant out); auth and webhook verification fail closed.
- Annual review: pricing, security posture (status pages, breach history), and whether each vendor still earns its place.
4. Agency-side suppliers
Contractors, stock-asset licences, fonts, plugins used in client work must be properly licensed for commercial/client use; licences are kept with the engagement record (SOP-11).