Who processes what
The seven third parties in the path, and which single one holds a plaintext value in memory.
Seven third parties sit in the path of a request. This is the register a Data Processing Agreement refers to, and it states plaintext exposure per row.
The register
| Third party | What it does | What it can access | Plaintext values |
|---|---|---|---|
| AWS KMS | Wraps the key that seals each value | Key material only. | none |
| Neon | The primary database | Ciphertext and metadata. Values are encrypted before they land. | none |
| Vercel | Application hosting and edge | Request routing, a coarse geo hint, and the compute that decrypts a value to serve it. | in memory |
| Resend | Sends transactional email | The recipient address, the subject, and the body of the message. | none |
| Upstash | Rate-limit counters and job locks | A counter and a key derived from an account or a source IP address. | none |
| Stripe | Payments, the default processor | Billing and payment data. | none |
| Paystack | Payments in African markets | Billing and payment data. | none |
The public copy of this table lives at /security/subprocessors, referenced by the agreement itself.
Why one row says "in memory"
Vercel runs the compute that opens a value to serve it, so plaintext exists there for the length of one request. Saying "no subprocessor sees plaintext" would be false, so the register says which one does. The mechanism behind it is on what the server can see.
AWS KMS handles key material and never sees a value. Neon stores sealed bytes and metadata and never sees a value. That is the boundary the table is drawn to make legible.
Two names you will not find here
Sentry and Axiom appear in older material and belong to neither list today. No error reporter is wired, and no operational log shipping is wired, so listing either one would describe a data flow that does not happen. They go on this page the day one receives its first event.
What is still to be decided
The notice period before a new third party starts, along with the hosting region of each one, is
unset in the deployment's legal configuration (apps/web/src/config/legal.ts). The privacy policy
highlights every unset value until it is filled in. Ask before you rely on a region.
Next: compliance posture.