1. The principle
No subprocessor has access to both planes. That separation is the same one that exists inside the system, and it extends to every vendor.
2. Touch the contact plane
- SMS messaging provider — delivers the acknowledgement to the person who requested contact and notifies the recipient. Sees a phone number and the message text. United States.
- Transactional email provider — the same function over email. Sees an email address and the message content. United States.
3. Touch no personal data
- Hosting and network — our own AlmaLinux infrastructure, behind a delivery network configured not to forward the client IP address to the services that receive signal.
- Object storage — posters, QR codes, and print materials. Contains no personal data.
- Secrets management — encryption keys and credentials, separated by plane. Contains no personal data.
The delivery network deserves a note. A CDN can see IP addresses by its nature. It is configured not to forward them to the application, does not restore the origin IP in any header, and access logs are off. The application cannot guarantee that about itself, so it is a deployment check rather than a claim in code.
4. Changes
We will give notice before adding a new subprocessor that processes contact-plane data, with reasonable time to object, in accordance with the Data Processing Addendum.