Pipefork Subprocessor Registry
Status: Draft registry, requires legal review before public commercial launch Last reviewed: 2026-07-07 Owner: Product / Operations Review cadence: Before production provider changes and at least quarterly
> This registry is operational documentation, not legal advice. Confirm the final production providers, signed Data Processing Addenda, regional settings, and international transfer mechanisms before public commercial launch.
Scope
This registry lists third-party service providers that may process personal data for Pipefork when Pipefork provides the Service. It should be updated before a new production provider is enabled for control-plane, runtime, billing, support, analytics, security, or operational processing.
Public route: /legal/subprocessors.
Customer-configured upstream APIs and workspace BYOK LLM providers are not Pipefork-selected subprocessors. They are customer-selected processors or subprocessors controlled by the workspace configuration.
Platform Subprocessors
| Provider | Purpose | Data categories | Typical location | Transfer basis to confirm | Status | Vendor legal reference |
|---|---|---|---|---|---|---|
| Vercel | Control-plane hosting, edge/network services, deployment logs | Account, usage, technical metadata, limited app logs | Provider-controlled regions; EU configuration should be confirmed | DPA and SCCs or applicable adequacy mechanism | Planned/active for control plane | https://vercel.com/legal/dpa |
| Supabase | Authentication, database, storage of control-plane records | Account, workspace, legal acceptance, API configuration, request-log metadata | Project region selected by Pipefork | DPA and SCCs or applicable adequacy mechanism | Planned/active for auth and database | https://supabase.com/legal/dpa |
| Neon | Alternative managed Postgres provider if selected instead of Supabase database hosting | Account, workspace, API configuration, operational metadata | Project region selected by Pipefork | DPA and SCCs or applicable adequacy mechanism | Optional/alternative | https://neon.tech/legal/dpa |
| Upstash | Redis/cache, rate limiting, queue-like operational state if enabled | Runtime metadata, cache entries, rate-limit counters | Database region selected by Pipefork | DPA and SCCs or applicable adequacy mechanism | Optional; active only when Upstash runtime env vars are configured | https://upstash.com/legal/data-processing-agreement |
| Stripe | Billing, checkout, customer portal, invoices, payment events | Billing identifiers, customer contact data, subscription and invoice metadata | Provider-controlled regions | DPA and SCCs or applicable adequacy mechanism | Planned/active only when paid billing is enabled | https://stripe.com/legal/dpa |
| Google Cloud | Cloud Run runtime plane, Secret Manager, logs, container and deployment infrastructure | Runtime metadata, service logs, encrypted secret material, operational metadata | Region selected by Pipefork | Cloud Data Processing Addendum and SCCs or applicable adequacy mechanism | Planned/active for managed runtime deployments | https://cloud.google.com/terms/data-processing-addendum |
| GitHub | Source control, CI/CD, issue/PR workflow, GitHub Actions | Repository metadata, build logs, deployment metadata, contributor metadata | Provider-controlled regions | DPA and SCCs or applicable adequacy mechanism | Active for development and CI/CD | https://docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement |
Customer-Selected Providers
| Provider class | Purpose | Data categories | Responsibility |
|---|---|---|---|
| Upstream APIs configured by a workspace | API facade execution, request composition, transformation, and response delivery | Data selected by the customer in API definitions and runtime requests | Customer must ensure lawful basis, notices, provider terms, retention, and transfer safeguards. |
| BYOK LLM providers configured by a workspace | Optional runtime LLM steps | Prompts, request-derived data, upstream response data, generated outputs, and provider metadata selected by the customer | Customer must enable the feature, configure the provider, and ensure lawful basis, notices, provider terms, retention, and transfer safeguards. |
| Customer-owned external secret providers | Secret storage or retrieval where supported | Secret names, references, provider audit metadata, and provider-managed encrypted values | Customer controls the external provider configuration, retention, deletion windows, audit logs, backups, and access controls. |
Change Process
Before adding or materially changing a Pipefork-selected production subprocessor:
- Confirm the provider purpose, data categories, production region, and transfer basis.
- Confirm that an appropriate DPA or equivalent data processing terms are in place.
- Update this registry and the Data Processing Addendum if the provider processes Customer Personal Data.
- Update the Privacy Policy if the change is material or changes recipient categories.
- Notify customers where required by the Data Processing Addendum or applicable law.
- Record the change in the relevant implementation or operations PR.
Open Launch Items
- Confirm final production provider set and regions.
- Confirm signed or accepted DPA terms for each active Pipefork-selected provider.
- Confirm whether optional analytics, email, support, or error monitoring providers are used at launch and add them before enabling them in production.