Vercel
Intended application hosting and server execution. Submitted content must be excluded from logs and caches.
Provider roles are published with deployment status.
The architecture separates hosting, operational records, email, billing, abuse prevention, private inference, analytics, and monitoring.
How to read this inventory.
A named provider describes an intended production role from the technical plan. It should be treated as active only when the corresponding service is configured in the deployed environment and covered by the applicable agreement.
A listed service does not receive personal data unless the corresponding product path uses that service.
Application and operational records.
Supabase
Application database for limited verification, consent, rate-limit, billing, contact, and onboarding records.
Email, billing, and abuse prevention.
Resend
Transactional verification email for analysis access and operational messages.
Stripe
Hosted checkout, recurring subscription, and customer portal.
Cloudflare Turnstile
Intended abuse prevention for analysis email and contact submissions. Candidate document content is not sent to Turnstile.
Inference and observability.
Modal
Intended private serverless inference environment. Payload logging, request capture, volumes, and snapshots must be disabled for analysis content.
Plausible
Intended cookieless, content-free website and funnel analytics. Candidate and free-form content must be excluded.
Sentry
Intended filtered error monitoring. Request bodies, replay, uploads, extracted text, model input, and result output must be disabled.
Changes and review.
A material new provider or processing role should be reviewed before activation, reflected in relevant agreements and policies, and added to this inventory with its purpose and data boundary.