Subprocessors and processing locations
The register will be published only after the actual production configuration and contracts have been verified.
The register has not yet been approved
The source code refers to providers of hosting, AI, sign-in, push notifications and future payments, but that alone does not establish which legal entities, regions and settings will be active in production. Publishing an unverified list would be misleading.
What the public register will contain
| Field | Required content |
|---|---|
| Supplier | Legal entity and specific service |
| Purpose | Why the supplier is necessary |
| Data | Categories of personal data and data subjects |
| Location | Processing and storage regions |
| Transfer | Mechanism, SCC module and supplementary measures |
| Retention | Retention period or intelligible criteria |
| Changes | Notice date and right to object under the DPA |
Public website hosting
The intention is to host the public pages on a paid Vercel Pro account. According to Vercel’s published terms, its DPA applies to Pro and Enterprise; production deployment on a free Hobby account is not acceptable for the commercial service.