Subprocessors

Version 1.2 · Effective 2026-09-02

# Subprocessor Registry

**Living SR&MA Platform**

> **Version**: 1.2
> **Last Updated**: 2026-09-02
> **Notification policy**: When a new subprocessor is added or an existing one is replaced, this page is updated and active users receive an email notification at least 30 days in advance. Users who object during the notification window may delete their account before the change takes effect (a "general authorization" model under GDPR Article 28(2), with the prior written authorization granted in advance through these terms).

This page discloses the subprocessors that the Living SR&MA Platform uses to deliver the service, in compliance with GDPR Article 28, UK GDPR Article 28, and APPI Articles 25 (supervision of trustees) and 27.

The Platform is a research-infrastructure tool for systematic reviews and meta-analyses. The list below covers the third parties that necessarily process personal data (or research-related data) when you use the Platform. Items configured by the user under a Bring Your Own Key (BYOK) model are explicitly noted because the legal relationship differs (the user is the controller; the Platform is a transmission conduit).

---

## 1. Subprocessors in Use

| Service | Provider | Purpose | Region | Data Transferred | DPA / Safeguards |
|---|---|---|---|---|---|
| **Supabase (Platform DB)** | Supabase Pte. Ltd (Singapore; data at rest in Tokyo) | Primary production PostgreSQL database for the Platform's personal-data store (`users`, `projects`, `refs`, `decisions`, `extractions`, Operator-side billing records) | Tokyo (`ap-northeast-1`), accessed through the Supabase session pooler | Operator-controlled account, project, reference, decision, extraction, audit, and billing data | [Supabase DPA](https://supabase.com/legal/dpa) **executed 2026-06-12** (PandaDoc Ref 999BT-KS3RY-KOLCX-MBZUH); SCCs (Modules 1-4) + UK Addendum (ICO B.1.0) + Swiss Addendum; Japan adequacy for EEA/UK-to-Japan data at rest; transfer impact assessment retained |
| **Fly.io** | Fly.io Inc. (United States) | Application runtime for the FastAPI service; no persistent personal-data store | `nrt` (Tokyo) | HTTP request/response payloads, session cookies, authentication tokens, and other data in transit | [Fly.io DPA](https://fly.io/legal/dpa/) executed 2026-06-12; 2021 SCCs (Module 2); DPF safeguards |
| **Cloudflare** | Cloudflare, Inc. (United States) | R2 database backups (`pg_dump -Fc`, rolling 30-day retention), operational-alert email routing, KV, and scheduled Workers | R2 default jurisdiction (global edge, region `auto`) | Server-side encrypted-at-rest backup objects containing copies of the production database, operational-alert recipient addresses, and limited operational metadata | [Cloudflare DPA](https://www.cloudflare.com/cloudflare-customer-dpa/) incorporated into the Main Agreement; EU/UK/Swiss SCCs |
| **Brevo** | Sendinblue SAS (France; headquartered in Paris) | Outgoing transactional email for screening invitations, notifications, magic-link login, the weekly newsletter, and service messages, relayed from the application (Fly.io, Tokyo) through the Brevo SMTP relay (`smtp-relay.brevo.com`) | European Union (France) | Recipient email address and message body, which may include study titles, author information, invitation links, and notification content | [Brevo Data Processing Agreement](https://www.brevo.com/legal/termsofuse/) incorporated as Appendix 3 of Brevo's Terms of Service and executed automatically on account creation. Primary hosting and processing within the EU (OVH France / Google Cloud France and Belgium); onward access by Brevo group sub-processors outside the EEA (e.g. Sendinblue Inc., USA; Brevo CRM Solutions Limited, India) is covered by the EU-U.S. Data Privacy Framework and SCCs per Brevo's DPA. Delivery to recipients in Japan and elsewhere continues as ordinary email delivery. DKIM (`brevo1`/`brevo2` selectors) and DMARC are configured for `yukifurukawa.jp`. |
| **Google OAuth** | Google LLC (United States) | Sign-in authentication and account profile retrieval | Global | OAuth token exchange data, email address, display name, profile picture URL | Google may act as an independent controller or processor as applicable to the OAuth processing context; DPF and SCC safeguards |
| **Paddle** | Paddle.com Market Ltd (United Kingdom) | Merchant-of-Record billing and payment processing if paid plans are enabled (production pending) | United Kingdom / global | Buyer name, email address, billing address, subscription metadata, tax information, payment status, and payment dispute data | [Paddle DPA](https://www.paddle.com/legal/data-processing-addendum) and [Data Sharing Addendum](https://www.paddle.com/legal/data-sharing-addendum). Paddle is the Merchant of Record and acts as controller/seller for buyer payment data; the Operator receives shared data as a separate controller. |

### Notes

- **BYOK Supabase (project-scoped)** (`specs/archive/byok-supabase.md`): When a project owner connects a separate Supabase project for that project's user research data and PDF storage, that Supabase project is under **the project owner's own controller relationship**, and the Platform performs only relay. Such project-scoped Supabase projects are therefore not listed in the table above, because they are not the Platform's subprocessors.
- **PDF storage**: The Platform does not store PDFs in Operator-controlled storage. PDFs are stored in the user's own Supabase project when BYOK storage is configured.

---

## 2. Data Transferred to Google via OAuth

When you sign in with Google, the following data is transferred to Google LLC:

- OAuth authentication token exchange.
- Retrieval of your Google account profile, including email address, display name, and profile picture URL.

Google may act as an independent controller or processor as applicable to the OAuth processing context. Transfers involving Google are supported by DPF and SCC safeguards as applicable. For users who prefer not to use Google OAuth, an email-and-password sign-in path is being evaluated for Phase B (currently Google OAuth is required).

---

## 3. Process for Adding or Replacing a Subprocessor

1. The Operator evaluates the candidate (scale, DPA availability, certifications, cost).
2. A draft entry is added to this page.
3. All active users are notified by email at least 30 days before the change takes effect.
4. Users who do not object are deemed to have maintained their general written authorization under GDPR Article 28(2). Users who object may export their data and delete their account before the change takes effect.
5. After the 30-day notification window, the change goes live in production and the entry on this page is finalized.

In urgent cases — for example, switching providers in response to a security incident — the notification window may be shortened to seven days. The reason is recorded on this page when this happens.

---

## 4. Subprocessor Change Log

| Date | Change | Notification Status |
|---|---|---|
| 2026-04-22 | v0.1 created with the initial infrastructure subprocessors. | Pending; notification will go out after the parent spec is approved. |
| 2026-04-26 | Promoted to v1.0 alongside Phase A implementation. | Draft published per spec §10-5. Existing active users (the Operator and the SLEEPI team) will be notified at launch. |
| 2026-05-05 | v1.1: Document fully translated to American English (Bundle D, `specs/micro-feedback-bundle-20260505.md` §6.9). No subprocessor changes. | Internal language update only; no user notification needed. |
| 2026-06-12 | Corrected the data flow to reflect that the production database is hosted on Supabase in Tokyo and the application runtime on Fly.io; added Cloudflare, Lolipop SMTP, and Paddle; removed Gmail SMTP; recorded the executed Fly.io DPA. | Immediate change notice required for already-active processors Cloudflare and Lolipop, with an effective date for EU and paid users. Thirty-day prior notice was not feasible because of beta operational drift; this exception is recorded here and should not be treated as the normal process. |
| 2026-07-05 | Wording corrections from the four-jurisdiction consistency review: replaced "implicit consent" with the GDPR Article 28(2) general-authorization framing in §3, and corrected the APPI citation to Articles 25 and 27. | Internal wording update only; no subprocessor changes; no user notification needed. |
| 2026-09-02 | v1.2: Replaced Lolipop SMTP (GMO Pepabo, Inc.) with Brevo (Sendinblue SAS, France) as the transactional email subprocessor (Brevo account and DPA executed 2026-08-30; production cutover 2026-09-02). Outgoing transactional email is now relayed from the application (Fly.io, Tokyo) through the Brevo SMTP relay (`smtp-relay.brevo.com`) with EU-based processing; DKIM (`brevo1`/`brevo2` selectors) and DMARC are configured for `yukifurukawa.jp`. Lolipop SMTP is retired from the sending role and GMO Pepabo no longer acts as a subprocessor; this resolves the Article 28 DPA gap documented for Lolipop SMTP. | Recorded as a §3 exception: the 30-day advance notice was shortened to an immediate cutover because the change resolves the documented Article 28 DPA gap and strengthens safeguards. Owner decision (2026-08-30): direct email notification waived — the Platform is in soft launch and the only active users are the Operator and the known internal SLEEPI team; this registry update serves as the notification record. |

---

## 5. DPA Status

| Subprocessor | DPA Status with the Platform | Next Action |
|---|---|---|
| Supabase (Platform DB) | **Executed 2026-06-12** via PandaDoc (Ref 999BT-KS3RY-KOLCX-MBZUH), Yuki Furukawa as controller; SCC Modules 1-4 + UK Addendum + Swiss Addendum included. | Executed DPA and transfer impact assessment retained off-repo. ✓ |
| Fly.io | **Executed 2026-06-12** (SCC Module 2 + DPF safeguards). | Retain the executed DPA on file. |
| Cloudflare | Incorporated into the Main Agreement; EU/UK/Swiss SCCs included. | Retain the reference and confirm R2, Email Routing, KV, and Workers remain within the covered Services definition. |
| Brevo | **Executed automatically on account creation (2026-08-30)** — the [Data Processing Agreement](https://www.brevo.com/legal/termsofuse/) is incorporated as Appendix 3 of Brevo's Terms of Service (Sendinblue SAS). | Retain the Terms of Service version accepted at account creation. |
| Google OAuth | DPF and SCC safeguards; role depends on the OAuth processing context. | Retain terms reference without overclaiming that a Google Cloud DPA alone governs OAuth userinfo processing. |
| Paddle | DPA and Data Sharing Addendum to be accepted on account activation / production flip. | Confirm at production flip and record the Merchant-of-Record controller split. |

---

## 6. Publication

This page is served as a system page on the Platform under the path `/subprocessors` (see Phase A §6.3 of the parent spec). The page is reachable from the global footer via the "Subprocessors" link.