Sub-processors

Every entry below was confirmed against this codebase — an API endpoint it calls, an env var it reads, a deployment config it ships with — or, for backup storage and email routing, against our production infrastructure and DNS records. This list covers every provider that stores or processes personal data for the hosted service, including backup storage; it was last checked on 2026-10-02. A confirmed entry is not the same as a legally-vetted sub-processor list; this page has not been reviewed by counsel, and it says so rather than pretending otherwise.

• Railway — application hosting, compute, and the managed Postgres database. Confirmed: this app deploys via a Railway-specific build config (railway.toml, Dockerfile), reads a Railway-injected commit SHA at runtime; our production infrastructure records show the production database on Railway’s managed Postgres service in the EU (Amsterdam region).
• Resend — transactional email delivery (workspace signup verification links, mobile-app sign-in links, enterprise invitations, password-reset links and account-security notices). Confirmed: the code calls api.resend.com directly when an API key is configured. Only active when an operator has configured RESEND_API_KEY and a from-address; without it, no email provider is called (an internal, non-production-reachable fallback path is used instead).
• Google (Firebase Cloud Messaging) — push notification delivery to the NOA Mandate Enterprise mobile app. Confirmed: the code calls fcm.googleapis.com when an operator has configured NOA_FCM_SERVICE_ACCOUNT; without it, no push is sent. The notification deliberately carries no request content — a fixed title and body plus a one-word message kind; approval details are visible only inside the authenticated app.
• Cloudflare — DNS and the reverse proxy in front of the public site, and email routing for the role addresses on this domain, and R2 object storage for production evidence-export bundles. Confirmed: the code authenticates an origin header from a Cloudflare Worker (lib/origin-trust.ts) as its trust boundary for public traffic. R2 evidence storage is configured ininfra/cloudflare/wrangler.evidence.production.jsonc andnoa-evidence-ingest.js. The domain’s DNS MX records point to Cloudflare Email Routing (checked 3 October 2026); delivery to individual role addresses is a separate routing check.
• Amazon Web Services (AWS) — encrypted backups of the production database (pgBackRest archive) and the recovery bucket, in the eu-central-1 region (Frankfurt). Confirmed: this repository’s operations runbook (docs/OPS-RUNBOOK.md) and our production infrastructure records show the production pgBackRest archive in an AWS S3 bucket in eu-central-1; release database dumps are archived to a separate recovery bucket in the same region.

• No analytics, advertising, or session-recording tracker of any kind was found in this codebase.
• No payment/billing processor is integrated in this codebase.

A signed Data Processing Agreement listing sub-processors contractually is not yet offered — that is stated plainly rather than promised. The technical list above is kept current against the code. See /privacy for how data is handled, and contact privacy@noamandate.com for enterprise DPA requests.