Sub-processors
Last verified against code: 2026-04-26 (series-a/tier-1 T1.10) Refresh trigger: any new entry in .env.example for an external service.
The "sub-processor" definition follows the GDPR Article 28 sense: any third party that processes personal data of a member, lead, or deal counterparty on behalf of OilFlow Network.
| # | Vendor | Region | Data processed | Purpose | Contract type |
|---|---|---|---|---|---|
| 1 | Anthropic, PBC | US (us-east-1) | Member application text (email, company name, beneficial owner names — minimised via shared/piiscrubber.py:anonymizefor_verification before send), match scoring inputs (anonymised supply/demand pairs), market intel raw HTML | Claude API for KYC risk assessment, deal scoring, intel synthesis | Anthropic Commercial Terms; Zero-day data retention enabled |
| 2 | Supabase, Inc. | US (Vercel ↔ Supabase US East) | Members, leads, supply/demand listings, matches, deal documents, error/audit logs | Primary database, auth, storage, realtime subscriptions | Supabase MSA; SOC 2 Type 2 attestation on file |
| 3 | Stripe, Inc. | US | Payment method, billing address, transaction amounts, customer email | Subscription billing + invoice payments | Stripe Services Agreement; PCI-DSS Level 1 certified |
| 4 | DocuSign, Inc. | US | Member name + email + company; signed PDF of NCNDA, LOI, ICPO, SCO, FCO, IMFPA, SPA contracts | E-signature, including HMAC-verified Connect webhooks | DocuSign MSA; FedRAMP-authorized |
| 5 | Resend, Inc. | US | Recipient email, message body (transactional + outreach) | Transactional email (member confirmations, reset links) and outreach campaigns | Resend ToS; SPF/DKIM/DMARC configured per-sending-domain |
| 6 | Vercel, Inc. | Global edge network | Frontend HTTP traffic (no DB writes), session cookies | Next.js hosting + edge runtime | Vercel Enterprise terms; SOC 2 Type 2 |
| 7 | Hostinger International Ltd. | EU (Lithuania) → VPS in chosen region | Agent process logs, daemon stdout/stderr | KVM2 VPS hosting the agent fleet (oilflow-daemon) | Hostinger Business; no member PII processed beyond what's in error_log (PII-scrubbed) |
| 8 | Sentry, Inc. | US | Stack traces from agents + frontend (PII scrubbed via shared/logger.py:scrubpii) | Crash reporting | Sentry MSA; PII scrubbing in before_send hook |
| 9 | Telegram Messenger LLP | Global (operator-only chat) | Operator alert messages — names hashed/truncated to 8 chars before send | Operator-only ops alerts (no member-facing communication) | Telegram Bot API ToS |
| 10 | OpenSanctions / OFAC / UN / EU / UK | Public datasets | Member name + company + country (sent to public APIs) | Sanctions screening | Public-data APIs; no PII retention by these providers |
| 11 | OpenCorporates | UK | Company name + country | Company-registration verification | OpenCorporates API ToS |
| 12 | Apollo.io / Hunter.io | US | Lead company + contact name (sent to public lookup APIs) | Lead enrichment | Per-API ToS; opt-out honored on leads.unsubscribed |
| 13 | TradingEconomics / EIA / MarineTraffic | US / Global | None (read-only public data) | Market intel data sources | Public-data APIs |
| 14 | GitHub | US | Repository contents + commit metadata | Source-of-truth for code; private repo | GitHub Enterprise terms |
| 15 | Cloudflare | Global edge | DNS, WAF, DDoS mitigation | Edge security | Cloudflare Enterprise terms |
Data flow simplification
`` [Member browser] │ (HTTPS) ▼ [Vercel edge — Next.js] ──→ [Supabase Postgres + Auth + Storage] │ (HTTPS) ▲ │ │ ▼ │ (HTTPS) [Resend] (transactional email) │ [Stripe] (payment) │ [DocuSign] (e-signature) │ │ [oilflow-daemon on Hostinger VPS] ─────┘ │ ├─→ [Anthropic Claude API] ├─→ [OpenSanctions / OFAC / UN / EU / UK] ├─→ [OpenCorporates / Apollo / Hunter] ├─→ [TradingEconomics / EIA / MarineTraffic] └─→ [Telegram Bot API] (operator alerts) ``
Adding a new sub-processor
Engineering checklist:
- Add the env var to
.env.examplewith a comment naming the service. - Add a row to the table above, including data class processed and
contract type.
- If the service processes PII, add the relevant API key to
SENSITIVEKEYS in shared/logger.py so the scrubber catches it in error_log payloads.
- If the service has a webhook, add HMAC verification + idempotency
dedup table (mirror processedwebhooks / processeddocusign_envelopes).
- Update
data-retention.mdwith the retention period for any data
the new sub-processor stores on our behalf.
- Note the addition in the changelog at the bottom of this file.
Changelog
- 2026-04-26: First version (series-a/tier-1 T1.10). Verified
against .env.example and code at commit time.