Subprocessor schedule

Infrastructure and database hosting

Production application hosting, managed PostgreSQL, networking, backups and related observability providers may process workspace content, account data, service metadata and logs solely to host, secure and recover the service. The approved schedule will name the exact provider entities and regions selected for production.

Email delivery and receiving

Resend is intended to deliver transactional and approved marketing messages and to receive the public role aliases through signed webhooks. It may process sender and recipient addresses, message content, safe threading headers, delivery events and attachment metadata. Signal OS does not ingest attachment contents in the initial release.

Security and abuse prevention

Cloudflare Turnstile is intended to process limited device, network and challenge data needed to protect public forms from automated abuse. Signal OS also uses its Railway-hosted application and PostgreSQL database to turn allowlisted public-site events directly into anonymous daily counters. No analytics visitor identifier or raw event ledger is created, and the counters are not used for advertising.

Billing

Paddle acts as Merchant of Record for customer checkout, tax and payment administration. Its role and independent-controller or processor status for each data category will be stated in the approved schedule. Revolut receives provider payouts and related financial records; customers do not check out through a separate Revolut merchant integration in the initial release.

Customer-directed intelligence and connectors

OpenRouter is intended to route bounded, customer-directed model requests to an approved endpoint for evidence extraction, classification, scoring and draft generation. The provider API key is platform-managed and prompt logging is not enabled by Signal OS. The public-safe categorisation route sends only a strict, non-personal organisation or commercial-building DTO, prefers the exact allowlisted NVIDIA Nemotron free endpoint and permits the exact allowlisted Dots Studio free endpoint as its sole transient recovery route. Raw search evidence, customer context, names, contact details, personal data and confidential data are rejected before either public-safe endpoint is called; the selected endpoint and model are audited. Personal-data-bearing workflows must use a separately approved compliant route or fail closed. Exact OpenRouter, NVIDIA and Dots Studio legal entities, endpoint locations, retention terms and transfer safeguards must be verified before approval.

Other enrichment, CRM, mailbox, calendar and data providers are used only when configured for the relevant workflow. Processing is limited to the customer-directed request and applicable product controls. Exact enabled providers, purposes and locations will be documented before they are available in production.

Changes and objections

The executed DPA will define advance notice for a new or replacement subprocessor and a reasonable mechanism for customers to raise a data-protection objection. Emergency changes needed to protect the service will be communicated as soon as reasonably practicable.