Sub-processors

Every entry below was confirmed against this codebase — an API endpoint it calls, an env var it reads, a deployment config it ships with. Nothing is inferred or assumed, and nothing is omitted: if a provider is not on this list, this codebase does not call it. A confirmed entry is not the same as a legally-vetted sub-processor list; this page has not been reviewed by counsel, and it says so rather than pretending otherwise.

• Railway — application hosting, compute, and the managed Postgres database. Confirmed: this app deploys via a Railway-specific build config (railway.toml, Dockerfile), reads a Railway-injected commit SHA at runtime, and this repository’s own CI backup job dumps the production database through the Railway Postgres service.
• Resend — transactional email delivery (console sign-in magic links, enterprise invitations). Confirmed: the code calls api.resend.com directly when an API key is configured. Only active when an operator has configured RESEND_API_KEY and a from-address; without it, no email provider is called (an internal, non-production-reachable fallback path is used instead).
• Google (Firebase Cloud Messaging) — push notification delivery to the NOA Mandate Enterprise mobile app. Confirmed: the code calls fcm.googleapis.com when an operator has configured NOA_FCM_SERVICE_ACCOUNT; without it, no push is sent. The notification deliberately carries no request content — a fixed title and body plus a one-word message kind; approval details are visible only inside the authenticated app.
• Cloudflare — DNS and the reverse proxy in front of the public site, and email routing for the role addresses on this domain. Confirmed: the code authenticates an origin header from a Cloudflare Worker (lib/origin-trust.ts) as its trust boundary for public traffic.

• No analytics, advertising, or session-recording tracker of any kind was found in this codebase.
• No payment/billing processor is integrated in this codebase.

A signed Data Processing Agreement listing sub-processors contractually is not yet offered — that is stated plainly rather than promised. The technical list above is kept current against the code. See /privacy for how data is handled, and contact privacy@noamandate.com for enterprise DPA requests.