Sub-processors
Who handles personal data for this site, what each receives, where, and since when. Files you open in the tools are not on this list because they never leave your device.
Checked against the code and the services on 1 October 2026. The addresses in each row are found by the build in the server's code and in the security policy every page is sent with; a new one stops the build until it is listed here.
Sub-processors
Three companies handle personal data for this site. None of them ever receives a file you open in a tool, because no tool sends one.
| Who | For what | What they receive | Where | Since | Addresses in the code |
|---|---|---|---|---|---|
| Cloudflare | Hosting: the pages, the server routes (Pages Functions), the store of records (Workers KV), the page count (a D1 database), and Cloudflare Web Analytics. | Every request, with the visitor's IP address and browser, as for any website, and the standard logs a host keeps. The records in the store: waitlist email addresses, seats (names and email addresses an admin typed), and the notes listed under What the server sees. The page count, which holds no personal data. Web Analytics reports that a page was viewed; it sets no cookie. | Cloudflare's network. The store and the count are in this site's own Cloudflare account; no region is chosen, so Cloudflare decides where copies are kept. | 25 August 2026 (the repository's first day; the site was on Cloudflare Pages before it) | static.cloudflareinsights.com, cloudflareinsights.com |
| Stripe | Payments, on Stripe's own checkout page, and the record of who has paid. | The buyer's name, email address, billing address and card, typed into Stripe's page, never this site's. The server sends Stripe only references (a checkout, subscription, invoice or customer) to make and renew keys, and creates a promotion code for an invitation. | Stripe's systems, under Stripe's own terms. | 25 August 2026 (payment links from the first day; the server first asked Stripe about a payment on 3 September 2026) | api.stripe.com, billing.stripe.com |
| Resend Not used until email is switched on | Sending email: a buyer's key and sign-in link, a seat invitation, a waitlist confirmation. | The recipient's email address and the message: the key and its link, or the invitation with the person's name. Not used until email is switched on (the RESEND_API_KEY secret in Cloudflare); until then nothing is sent to Resend. | Resend's systems, under Resend's own terms. | 8 September 2026 (in the code since then, and not used until email is switched on) | api.resend.com |
Services that receive no personal data
The server also asks these for public data, or passes them a question that identifies nobody. They are not sub-processors, because nothing about a visitor or a customer reaches them; they are here so that every address the server contacts is accounted for.
| Who | For what | Since | Addresses in the code |
|---|---|---|---|
| GitHub | Runs the scheduled status check and signs each release (GitHub Actions), and keeps both records in a gist, which /api/status and /api/release-signature read; keeps the repository. | 28 September 2026 | gist.githubusercontent.com |
| OSV.dev (Google) | Answers the Sovereign Suite's dependency check, passed on by /api/osv. | 27 September 2026 | api.osv.dev |
| DigiCert | Its public time-stamping authority, for PDF Studio's trusted timestamps and Authorship's, passed on by /api/tsa: a hash, never the document. | 30 September 2026 | timestamp.digicert.com |
| Sectigo | The same, when DigiCert does not answer. | 30 September 2026 | timestamp.sectigo.com |
| Have I Been Pwned | Answers PWNCHECK, passed on by /api/pwned: five characters of a hash. | 5 September 2026 | api.pwnedpasswords.com |
| CISA | Its public list of exploited vulnerabilities, fetched whole. | 28 September 2026 | www.cisa.gov |
| FIRST (EPSS) | Its public daily scores, fetched whole. | 28 September 2026 | epss.cyentia.com |
| jsDelivr | The libraries on the shelf, fetched once by the edge and checked against a pinned hash. | 7 September 2026 | cdn.jsdelivr.net |
| Hugging Face | The speech model SCRIBE uses, fetched once by the edge. | 7 September 2026 | huggingface.co |
| TensorFlow Hub | The face detection model VEIL uses, fetched once by the edge. | 7 September 2026 | tfhub.dev |
Called from your browser, by you
The Sovereign Suite's connectors read your own accounts at these providers, from your browser, with a token or sign-in you give it. Nothing passes through this site, and this site never holds the token or what comes back. These providers are yours, under your agreement with them; they are not this site's sub-processors. No other page may reach them.
| Address | What it is |
|---|---|
api.github.com | Your GitHub organisation, read by the Sovereign Suite's connector with a token you give it. |
gitlab.com | Your GitLab group on gitlab.com, read by the Sovereign Suite’s connector with a token you give it. |
graph.microsoft.com | Your Microsoft 365 tenant, read by its connector after you sign in. |
login.microsoftonline.com | Microsoft's sign-in, for that connector. |
admin.googleapis.com | Your Google Workspace, read by its connector after you sign in. |
*.okta.com | Your Okta organisation, read by its connector with a token you give it. |
*.okta-emea.com | The same, for an Okta organisation in its EMEA cell. |
*.oktapreview.com | The same, for an Okta preview organisation. |
When this list changes
Before a sub-processor is added or replaced, this page changes and the address each Team and Business subscription was paid with is emailed at least thirty days ahead, as the data processing agreement says. You may object, or end the subscription with a refund of the unused part.
Resend is on the list already and is not used yet. Switching email on is not a new sub-processor; it is this one starting work, and this page will say so on the day.
Changes since this list was first published, on 1 October 2026: none.