Subprocessors
Last updated: · Draft version: draft-2026-10-13.1
Detected provider inventory
Detected services are listed below. Contracting entities, processing locations and production enablement remain subject to verification. A detected integration is not proof that it receives customer data.
| Provider | Purpose | Status / locations |
|---|---|---|
| Stripe | Hosted checkout, subscription billing and refunds | Detected in billing code [TODO: verify processing locations and contracting entity] |
| Amazon Web Services | Hosting, tenant infrastructure, backups and SES transactional email | Detected in infrastructure and email code [TODO: verify all account, telemetry, backup and email regions] |
| Brevo | Newsletter subscription and marketing email | Detected in newsletter code [TODO: verify processing locations and contracting entity] |
| Google reCAPTCHA | Newsletter form abuse prevention | Detected in form code; cookie classification pending review [TODO: verify processing locations and contractual role] |
| Microsoft Entra ID | Single sign-on authentication | Detected in configured SSO issuer [TODO: verify configured tenant and processing locations] |
| Google Firebase / Firestore | Optional telemetry backup | Conditional code path; production use not confirmed [TODO: confirm whether enabled; remove if unused] |
[TODO: Verify signed processor agreements, applicable safeguards, locations and notification procedures.]
Changes and questions
For questions or a contractual list, contact privacy@observagent.cloud.
[TODO: Distinguish processors of customer telemetry from independent controllers and website-only vendors. Approve change notices and any objection process; verify Firebase production use.]