# VenturePath Subprocessor Register: Owner and Counsel Review Copy

**Version:** 0.5 · **Review date:** 3 October 2026

The production register must identify the contracting entity, service, purpose, data, processing location, transfer safeguard, status, and change date. Vendor branding alone is not enough.

| Provider | Purpose | Data | Location/transfer | Status |
|---|---|---|---|---|
| OpenAI Sites / associated hosting infrastructure | Public early-access hosting and delivery | Public interface assets; ordinary technical/security logs | Contracting entity, processing locations and applicable terms remain pending vendor verification | Active for public delivery; complete vendor record before broader public launch |
| Supabase | Authentication, Postgres database, authorization, Edge Functions and private profile-image storage | Accounts, workspace records, profile images, consent receipts, preferences and audit metadata | Tokyo (`ap-northeast-1`); contracting entity, DPA and transfer safeguards remain pending vendor verification | Active for controlled account access |
| Cloudflare Turnstile | Automated-abuse protection for account and contact forms | IP address and browser/device signals used to produce a challenge token | Contracting entity, locations, terms and transfer safeguards remain pending vendor verification | Active when the deployment has a Turnstile site key configured |
| Resend | Delivery of contact-form messages | Verified email address, contact name, topic, message and delivery metadata | Contracting entity, locations, DPA, retention and transfer safeguards remain pending vendor verification | Active when the server has a Resend API key configured |
| Microsoft 365 | Operator mailboxes for support, privacy, security and administrative correspondence | Sender and recipient addresses, message content, attachments and delivery metadata supplied by the correspondent | Contracting entity, locations, DPA, retention and transfer safeguards remain pending vendor verification | Active for published VenturePath mailboxes; delivery monitoring remains an operator control |
| AI provider(s) | User-invoked research/challenge/synthesis | Minimum approved/pseudonymized context and output | No provider selected; terms, retention, training use and region must be reviewed before activation | Not connected |
| Sentry | Browser error monitoring and incident investigation | Scrubbed exception, stack, browser and route metadata; no session replay, request body or account identity by configuration | US ingestion endpoint; confirm contracting entity, DPA, retention and transfers | Configured for controlled release |
| PostHog | Optional consented feature-adoption analytics | Allow-listed event and limited browser/device metadata plus opaque account ID; excludes venture answers, interview content, email, display name, IP enrichment and session replay | PostHog Cloud US; confirm DPA, retention and transfers | Configured; capture remains off until individual opt-in |

Before activation: due diligence, written processor terms, security review, least data, region/transfer assessment, deletion/return, breach obligations, subprocessor controls, and privacy-notice update. Material additions require advance notice and a reasonable objection/termination mechanism for business customers.