Subprocessor Register
Version 0.6 · 15 October 2026
Owner and qualified-counsel review copy
Source SHA-256: 0bae03a530761eb048565e3ba1c42a073a7b1df91394da9c790bd83bbc1e3cfe
VenturePath Subprocessor Register: Owner and Counsel Review Copy
Version: 0.6 · Review date: 15 October 2026
The production register must identify the contracting entity, service, purpose, data, processing location, transfer safeguard, status, and change date. Vendor branding alone is not enough.
| Provider | Purpose | Data | Location/transfer | Status |
|---|---|---|---|---|
| OpenAI Sites / associated hosting infrastructure | Public early-access hosting and delivery | Public interface assets; ordinary technical/security logs | Contracting entity, processing locations and applicable terms remain pending vendor verification | Active for public delivery; complete vendor record before broader public launch |
| Supabase | Authentication, Postgres database, authorization, Edge Functions and private profile-image storage | Accounts, workspace records, profile images, consent receipts, preferences and audit metadata | Tokyo (ap-northeast-1); contracting entity, DPA and transfer safeguards remain pending vendor verification | Active for controlled account access |
| Cloudflare Turnstile | Automated-abuse protection for account and contact forms | IP address and browser/device signals used to produce a challenge token | Contracting entity, locations, terms and transfer safeguards remain pending vendor verification | Active when the deployment has a Turnstile site key configured |
| Resend | Delivery of account confirmation, password-reset and login-verification emails, and contact-form messages | Registered email address, one-time account/login codes or verification/reset links, email delivery metadata, and verified contact-form name, topic and message | Contracting entity, locations, DPA, retention and transfer safeguards remain pending vendor verification | Active when the server has a Resend API key configured |
| Microsoft 365 | Operator mailboxes for support, privacy, security and administrative correspondence | Sender and recipient addresses, message content, attachments and delivery metadata supplied by the correspondent | Contracting entity, locations, DPA, retention and transfer safeguards remain pending vendor verification | Active for published VenturePath mailboxes; delivery monitoring remains an operator control |
| AI provider(s) | User-invoked research/challenge/synthesis | Minimum approved/pseudonymized context and output | No provider selected; terms, retention, training use and region must be reviewed before activation | Not connected |
| Sentry | Browser error monitoring and incident investigation | Scrubbed exception, stack, browser and route metadata; no session replay, request body or account identity by configuration | US ingestion endpoint; confirm contracting entity, DPA, retention and transfers | Configured for controlled release |
| PostHog | Optional consented feature-adoption analytics | Allow-listed event and limited browser/device metadata plus opaque account ID; excludes venture answers, interview content, email, display name, IP enrichment and session replay | PostHog Cloud US; confirm DPA, retention and transfers | Configured; capture remains off until individual opt-in |
Before activation: due diligence, written processor terms, security review, least data, region/transfer assessment, deletion/return, breach obligations, subprocessor controls, and privacy-notice update. Material additions require advance notice and a reasonable objection/termination mechanism for business customers.