Service Provider and Subprocessor Directory

1. How to read this directory

SourceWarden LLC uses defined providers to operate EvidenceGuard. This directory is part of the version 1.0 data-processing package and identifies the permitted service roles, not a blanket authorization to use every product, affiliate or region of a listed company. A provider can have different roles for customer content, its own account administration and legal compliance.

“Core” means a service used by the documented baseline architecture. “Conditional” means the stated function may be used only when actually configured and authorized; it is not a statement that the function is currently available. The list is an authorization scope when incorporated into an accepted DPA, not evidence that a particular vendor agreement has been separately signed or that a provider’s general marketing claims apply to every account.

The standard application and primary document storage are United States based. Some providers are headquartered elsewhere or operate administrative, support and security services internationally. A primary region must not be described as an all-processing residency guarantee. Required restricted-transfer safeguards must be established before the affected data is processed.

2. Core infrastructure and identity

DigitalOcean, LLC — core hosting and managed database

Service: Application hosting, API and background services, bounded document-processing infrastructure, and managed PostgreSQL business data.

Data scope: Authorized documents and temporary representations processed on the hosted systems; extracted or derived material stored in the application database; account/organization references, review and audit metadata, credit records and necessary technical records. Access is limited by the deployment and service role.

Location: Selected United States deployment. Provider administration, incident response and support can have additional locations under the applicable service arrangement. This is not a claim of dedicated tenancy or a specific recovery guarantee.

Role: Processor/subprocessor for hosted Customer Personal Data; independent responsibilities may apply to DigitalOcean’s own commercial relationship with SourceWarden.

Amazon Web Services, Inc. — core private S3 storage

Service: Private object storage for authorized original files and permitted derived objects, including relevant object-version and access records.

Data scope: The specific objects and necessary storage, authorization and operational metadata. An upload grant is limited access to a defined object, not public access to the storage account.

Location: Selected United States S3 region for the standard offering. Any replica, backup or support handling must follow the accepted scope and applicable transfer safeguards; no global no-copy promise is made.

Role: Processor/subprocessor for stored Customer Personal Data. No external-model analysis is authorized by use of S3.

Supabase Pte. Ltd. — core authentication

Service: Account authentication, sign-in/session handling and associated identity-service operation.

Data scope: Account identity and sign-in information, necessary authentication metadata and relevant service-support records. Supabase is not designated as the primary procurement-document database in this architecture, and document bodies must not be added to its authentication payloads.

Location: Selected United States project region for primary authentication service data. Supabase’s contracting entity is based in Singapore and its administrative/support arrangements may be international. A project-region selection is not a statement that all Supabase operations occur in the United States.

Role: Processor/subprocessor for the designated account function, subject to the actual account contract. Any material difference in the receiving entity must be resolved and disclosed before the affected processing.

3. Domain, communications and conditional commercial services

Cloudflare, Inc. — domain and DNS

Cloudflare supplies domain-registration and DNS-related services for the site. Relevant data can include domain/contact information, DNS and service-request metadata and provider account records. Its infrastructure is global. This baseline role does not authorize external document analysis, an undisclosed Workers application or a new content-bearing proxy path. Adding such a role requires an updated assessment and, where applicable, the DPA change procedure.

Plus Five Five, Inc. (Resend) — conditional transactional email

Resend can deliver operational or authentication-related messages when configured. The scope is recipient details, necessary safe message content and delivery metadata, not raw procurement documents or attachments. Its service and support arrangements may be international; no regional restriction or fixed provider log-retention promise is inferred solely from the ability to send email. The actual sending path and agreement must match this scope before use.

Stripe, Inc. — conditional payment processing

Where an actual live Stripe checkout is offered, Stripe handles payment details and necessary billing, payment status, fraud and transaction records. Stripe may act under its own legal responsibilities for regulated payment and fraud-prevention activities as well as provide contracted services. No customer-document analysis role is assigned to it. A sandbox integration is not an active paid offer, and no charge is authorized merely by this directory.

Google LLC — ordinary contact email and customer-selected sign-in

The designated Gmail contact processes ordinary support, legal, privacy and billing correspondence sent to it. This is not permission to send confidential bid documents, credentials or unnecessary personal records through email. A suitably limited secure route must be arranged for confidential support material. Gmail’s consumer-service terms do not by themselves establish a negotiated enterprise processing arrangement for uploaded Customer Content.

Where an enabled customer-selected Google sign-in is used, identity assertions and account information needed for that sign-in are handled under the applicable sign-in provider relationship. Provider-controlled account, communications and security handling can occur internationally. These activities must not be confused with hosting the customer’s document database.

Other customer-selected identity services, including Microsoft where enabled, receive the information needed for the sign-in the customer requests and act under their applicable relationship and notices. The availability of an identity-provider button must reflect the actual configuration. A material new Provider-appointed processing role requires a directory update before use.

4. What is not an authorized document subprocessor

No external AI provider is authorized to receive Customer Content in the baseline. OpenAI or another model-provider name in source code or a product plan does not grant authorization. Any later provider must be identified with its actual service, purpose, content scope, location and data-handling arrangement before use under the AI Addendum and DPA.

Self-hosted components such as Tesseract, ClamAV, PDFium, Caddy or Nginx are software components, not separate external document recipients simply because their software is installed. Any actual outbound service call by such software must still be assessed.

Source-code, build-registry, administrative-network and corporate-banking providers are not approved destinations for confidential customer documents merely because SourceWarden uses them internally. Do not place Customer Content in public issues, build artifacts, general-purpose chat tools or bank-account verification records. A new vendor with a relevant personal-data role must be inventoried and disclosed before that role starts.

5. Safeguards, changes and questions

We must maintain the required agreements and safeguards for each processor role and match the service configuration to this directory. Public provider terms are useful information, not proof of SourceWarden’s account-level activation, signatures, retention settings or international-transfer assessment.

Material subprocessor additions, replacements or scope expansions follow the DPA’s 30-day advance-notice and objection procedure, subject to its narrow urgent exception. Notice is sent to the customer’s designated account or DPA contact; a customer does not have to discover a silent new document recipient by repeatedly checking a webpage.

For a provider, region, onward-processing or contract-safeguard question, email kun11451454188@gmail.com, subject “EvidenceGuard subprocessors.” We will provide relevant information and permitted contract evidence without disclosing another customer’s information, secrets or protected security detail. Postal contact: SourceWarden LLC, 7155 Kindred Street, Philadelphia, PA 19149-1132, United States.