REVIEW-READY DRAFT — GBOS-specific and factual, but NOT final and NOT legal advice. Must be confirmed by a qualified solicitor before GBOS relies on it (see the [SOLICITOR TO CONFIRM] items).

Sub-processors

Version 2026-08-r1 · Effective 2026-08-02

The third parties GBOS uses to process personal data, and their role.

Current sub-processors

Neon — managed PostgreSQL database (primary datastore for all tenant data). Region: [OWNER TO PIN].

Vercel — application hosting, edge/CDN and serverless compute. Region: [OWNER TO PIN].

Vercel Analytics — aggregate product usage analytics (consent-gated where required).

Planned / not-yet-selected sub-processors (TBD-vendor)

Email delivery (verification, password reset, notifications) — TBD-vendor (candidates: Resend / Amazon SES / Postmark). A delivery seam exists (webhook) but is not wired to a live provider; production boot is blocked until it is configured.

Key Management Service (KMS) for the secret vault — TBD-vendor (candidates: AWS KMS / GCP KMS / HashiCorp Vault). The KMS seam is present but not activated.

Monitoring / error tracking — TBD-vendor.

Change notification

We keep this list current and notify customers of additions in advance, allowing a reasonable period to object on reasonable data-protection grounds (see the DPA). [SOLICITOR TO CONFIRM] the notification mechanism and objection window.

Clauses a solicitor must confirm

The following points in this document require qualified legal sign-off before GBOS relies on it.

That every live sub-processor has a signed DPA / SCCs in place before go-live.
The final list once the email, KMS and monitoring vendors are chosen (currently TBD-vendor).
The pinned processing regions for each provider to match residency commitments.

This document is a GBOS-specific, review-ready draft. It is not final and does not constitute legal advice; it must be confirmed by a qualified solicitor (see the clauses flagged above) before GBOS relies on it.