{"schemaVersion":1,"lastUpdated":"2026-04-22","subProcessors":[{"id":"supabase","name":"Supabase","purpose":"Managed Postgres, authentication, file storage, realtime, and edge functions. The primary system of record for CBSC.","region":"US (us-east-1)","dpaUrl":"https://supabase.com/legal/dpa","homeUrl":"https://supabase.com"},{"id":"vercel","name":"Vercel","purpose":"Hosting and edge delivery of the CBSC Next.js application.","region":"Global edge; origin US","dpaUrl":"https://vercel.com/legal/dpa","homeUrl":"https://vercel.com"},{"id":"stripe","name":"Stripe","purpose":"Subscription billing, checkout, and card processing. Stripe handles PCI scope — CBSC never sees card numbers.","region":"US, with global processing network","dpaUrl":"https://stripe.com/legal/dpa","homeUrl":"https://stripe.com"},{"id":"resend","name":"Resend","purpose":"Transactional email delivery (verification, password reset, billing receipts, privacy-request acknowledgements).","region":"US","dpaUrl":"https://resend.com/legal/dpa","homeUrl":"https://resend.com"},{"id":"sentry","name":"Sentry","purpose":"Application error tracking. PII is scrubbed at ingest per spec §9.6; traces retain no family or swimmer identifiers.","region":"US","dpaUrl":"https://sentry.io/legal/dpa/","homeUrl":"https://sentry.io"},{"id":"axiom","name":"Axiom","purpose":"Server log storage with a 90-day retention window (see Retention table).","region":"US","dpaUrl":"https://axiom.co/legal/dpa","homeUrl":"https://axiom.co"},{"id":"cloudflare","name":"Cloudflare","purpose":"DNS and CDN for the cbsc domain. No customer personal data is stored at Cloudflare; only request metadata transits.","region":"Global","dpaUrl":"https://www.cloudflare.com/cloudflare-customer-dpa/","homeUrl":"https://www.cloudflare.com"}]}