cyberpigeon| Provider | Purpose / data | Current status and location |
|---|---|---|
| Microsoft Azure | Application hosting, private PostgreSQL, backups, secret storage and operational logs | Active. Application resources in North Europe (Ireland). Vendor-wide support and processing terms also apply. |
| Resend / Plus Five Five, Inc. | Email transmission, receipt, delivery events and inbound attachment storage | Planned; delivery requires activation. Domain configuration targets eu-west-1, but this does not establish EU-only processing. |
Authoritative vendor terms: Microsoft DPA, Resend DPA, and Resend subprocessors. Resend lists subprocessors in the United States. We must assess the relevant transfer safeguards and vendor contracts before activating customer personal-data processing. This list does not assert that a particular contract has been executed.
Other infrastructure
GoDaddy manages the current domain registration and DNS; it is not the application or mailbox host. GitHub holds source code and CI, not production mailbox data. Stripe provides hosted Checkout, recurring Billing, the customer portal and Stripe Tax. Billing information is shared with Stripe, which may act as a processor or independent controller depending on the service; its data processing terms and privacy notice describe its roles and international processing. Cyberpigeon does not send message content to an LLM in its application code. Customers may connect agents or LLMs themselves and remain responsible for those integrations.
Changes
Before production processing, the executed DPA must specify advance notice and objection arrangements for subprocessor changes. Review date: September 11, 2026.