Trust
Subprocessors
Last updated: 2026-04-25 · 16 vendors · 1 CUI-adjacent
Every third-party service that processes data on behalf of Xpoose CyberSec. The list is generated from infrastructure/subprocessors.yaml in the source repository — it cannot drift silently.
CUI-adjacent vendors
One vendoron this list may touch Controlled Unclassified Information. Per ADR-016 we run those through a customer-managed-key (BYOK) flow: plaintext bodies never leave the customer’s key boundary unencrypted, and we hold a per-object HMAC so we can detect tampering even if the vendor side were compromised.
Identity & access
How operators and customers prove they are who they say they are.
- Clerk
Authentication, sessions, organizations, passkeys, hardware-key admin auth
- Region
- United States
- Data
- email, name, session_metadata, org_membership
- Added
- 2026-03-01
Hosting & infrastructure
Where the platform runs and stores its data.
- Cloudflare R2
Object storage for marketing assets, signed PDFs, OTA artifacts
- Region
- ENAM
- Data
- public marketing files, signed legal PDFs, firmware images
- Added
- 2026-03-01
- Neon
Primary PostgreSQL database for the portal
- Region
- AWS us-east-2
- Data
- all portal data — engagements, audit, billing metadata
- Added
- 2026-03-01
- Upstash
Redis — rate-limit counters and idempotency-key dedup cache
- Region
- AWS us-east-1 (global edge replicas)
- Data
- hashed actor identifiers, request hashes, counters
- Added
- 2026-03-01
- Vercel
Hosting + edge runtime for the portal and marketing site
- Region
- ENAM (Eastern North America)
- Data
- request metadata, IP addresses, user agents
- Added
- 2026-03-01
Observability
What we measure to keep the platform reliable and to detect failure.
- Axiom
Structured log + trace ingestion for portal + cron jobs
- Region
- United States
- Data
- request metadata, trace IDs, error stacks (PII-redacted at emit)
- Added
- 2026-04-25
- DPA
- axiom.co/dpa
- PagerDuty
On-call incident paging for P1/P2 alerts
- Region
- United States
- Data
- incident title, summary, trace IDs, on-call contacts
- Added
- 2026-04-25
- Plausible
Cookie-free marketing-site analytics (page views, referrers)
- Region
- European Union
- Data
- URL path, referrer, hashed visitor fingerprint (rotating salt, 24h)
- Added
- 2026-04-25
- PostHog
Product analytics on signed-in portal events + server-side feature flags
- Region
- United States
- Data
- Clerk user_id, org_id, event names + properties (PII-redacted)
- Added
- 2026-04-25
- Sentry
Error tracking + release health for portal + Consigliere
- Region
- United States
- Data
- exception messages, stack traces, redacted breadcrumbs
- Added
- 2026-04-25
Communications
Outbound notifications to customers, operators, and prospects.
- Resend
Transactional email (welcome, receipts, security alerts)
- Region
- United States
- Data
- recipient email, subject, body — non-CUI only
- Added
- 2026-04-25
Payments
Subscription billing and one-time charges.
- Stripe
Subscription billing, invoices, checkout, customer portal
- Region
- United States
- Data
- billing contact, payment method tokens, invoice metadata
- Added
- 2026-03-01
Scheduling
Calendar booking surfaces.
- Cal.com
Exposure-call booking surface for prospects + clients
- Region
- United States
- Data
- name, email, calendar event metadata, booking notes
- Added
- 2026-04-25
- DPA
- cal.com/dpa
CUI enclave
Customer-managed-key encrypted storage for Controlled Unclassified Information. These vendors require additional counsel review per ADR-016.
- PreVeilCUI
Customer-managed-key encrypted storage for CUI artifacts (CMMC L2)
- Region
- United States (PreVeil GovCloud-cleared infrastructure)
- Data
- Controlled Unclassified Information bodies — end-to-end encrypted
- Added
- 2026-04-25
E-signature
Legally binding electronic signature workflows.
- DocuSign
MSA + work-order signature envelopes
- Region
- United States
- Data
- signer name, email, IP, signed PDF artifacts
- Added
- 2026-04-25
Background jobs
Background job execution and retry queues.
- Inngest
Background jobs (cron schedules, webhook processing, retry queues)
- Region
- United States
- Data
- job inputs (PII-redacted), trace IDs
- Added
- 2026-04-25
How we update this list
- Adding a vendor: PR to
infrastructure/subprocessors.yaml; CUI-adjacent vendors require an extra counsel review. - Removing a vendor: same PR, plus a
subprocessor-removed: <name>trailer so the CI drift check accepts the deletion. - Customers receive advance notice per the Privacy Policy before a new vendor that handles customer data goes live.