AODAChecker
Subprocessors
Implemented architecture; production accounts and regions have not yet been provisioned or verified.
| Provider | Role | Region / status |
|---|---|---|
| Supabase | Identity, PostgreSQL and private storage | Canada Central proposed; actual setup to confirm |
| Vercel | Web application | Actual region to confirm; do not assume Canada |
| Resend | Auth emails via SMTP and application notices | Cross-border processing to document in contract |
| OpenAI | Optional explanation improvement from minimized data | Contract and region to validate; application storage disabled, abuse-monitoring retention possible |
| Stripe | Hosted payments and invoices | Operator account and processing locations to confirm |
| Controlled scanner host | Isolated rendering of public pages | Host, country and network evidence required |
Evidence URLs are not sent to the scanner. Provider secrets are unavailable to the browser visiting websites. No advertising tool is used. OpenAI receives no identity, URLs, raw HTML or observed text. Application storage is disabled (store: false); this is not a Zero Data Retention guarantee. Abuse-monitoring logs may be retained for up to 30 days by default. Production contracts and regions still need validation.