Subprocessors and service providers for Something

Version 0.1 · Last updated 30 October 2026 ·

Draft. Every link below returned HTTP 200 on 2026-10-30 unless noted. Transfer mechanisms are as each provider states them on its own pages on that date. The US Department of Commerce DPF participant list (https://www.dataprivacyframework.gov/list) needs a browser and was not read; DPF claims below are the providers’ own. Rows marked “planned” or “under consideration” are not in use yet and must be moved to “in use” or deleted before this page goes live.

This page lists the companies that process personal data on behalf of BAARS DESIGN to run Something. It is the subprocessor list referred to in the Privacy Policy and in Annex 3 of the Data Processing Agreement.

Changes. We update this page before adding or replacing a subprocessor. Customers with a signed DPA receive an email at least 30 days before the change and may object as the DPA describes. Anyone can subscribe to changes by emailing [something@baars.design] with the subject “Subprocessor updates”.

In use today

Provider	Purpose	Data	Location	Transfer mechanism	Links
Oracle Corporation (Oracle Cloud Infrastructure)	Hosts BAARS DESIGN’s own mail server (`mail.baars.design`, Mail-in-a-Box) used for support email and transactional email	Email addresses, names, message content of email sent to or from us	Server IP 144.21.40.114 is registered to Oracle (RIPE RDAP, registrant Oracle Svenska AB). The admin record names the Amsterdam region (`eu-amsterdam-1`, Netherlands); the region itself was not independently verified. Oracle is a US company.	Oracle’s Data Processing Agreement for Oracle Services (SCCs). The PDF at the link is dated 2019 in its URL; confirm the current version in the Oracle account.	Privacy · Contracts · DPA PDF
GitHub, Inc.	Hosts the public release feed and installers (`github.com/the-baaron/something-releases`) that installed copies fetch on update checks	IP address and user-agent of the Mac checking for updates. No account data.	United States	GitHub states it complies with the EU-U.S. DPF, UK Extension and Swiss-U.S. DPF, and relies on SCCs (2021/914) otherwise. Privacy Statement effective 2026-04-27. GitHub DPA version October 2025.	Privacy Statement · DPA (returned HTTP 500 to a direct request twice on 2026-10-30; loaded via a fetch tool) · GitHub’s subprocessors

Planned for launch (not yet created or configured)

Provider	Purpose	Data	Location	Transfer mechanism	Links
Supabase Pte. Ltd	Account sign-in (Supabase Auth): Google, Apple and email-code sign-in, user records, session tokens	Email, name, sign-in provider id, sign-in IP and times, hashed tokens	Project data to be hosted on AWS in Stockholm, Sweden (`eu-north-1`, listed on Supabase’s regions page). Supabase’s own subprocessors (list dated 2026-10-12) include Amazon Web Services (US), Cloudflare (US), Google LLC (US hosting), Vercel (US), Postmark, Sentry, Front, HubSpot and OpenAI (US), ConfigCat (Hungary). Supabase Pte. Ltd is in Singapore.	Supabase DPA v1 (2026-08-01): EU SCCs (2021/914) with UK and Swiss addenda; acceptance of the Supabase agreement counts as signing the SCCs. No DPF claim.	DPA · Privacy · Subprocessor list · Regions
Stripe Payments Europe, Limited (Ireland), with Stripe, LLC (US) and affiliates	Payments, subscriptions, invoices, tax calculation (Stripe Tax), customer billing portal	Billing name, address, email, VAT number, card details (entered on Stripe’s pages; we never receive the full number), payment history	Contracting entity for a business in Norway is Stripe Payments Europe, Limited (Stripe Services Agreement, 2026-09-28). Data is also processed in the US.	Stripe DPA (last updated 2026-09-28) with Data Transfers Addendum: EU SCCs (2021/914) Modules 1, 2 and 3; Stripe, LLC states it is certified under the EU-U.S. DPF, Swiss-U.S. DPF and UK Extension (Stripe Privacy Center). Stripe is a processor for our services and an independent controller for fraud prevention and compliance.	DPA · Privacy Policy (2026-04-28) · Privacy Center · Services Agreement
Google LLC	Sign-in provider, if the user chooses “Sign in with Google”	Google sends us email, name, profile picture and a user id (`openid`, `email`, `profile` scopes). Google receives the fact that the user signed in to Something.	United States	Google is an independent controller for the sign-in, not our processor. Google LLC states it is certified under the EU-U.S. DPF, UK Extension and Swiss-U.S. DPF (“Data transfer frameworks”, effective 2025-08-23).	Privacy · Frameworks
Apple Distribution International Limited (Ireland)	Sign-in provider, if the user chooses “Sign in with Apple”	Apple sends us a unique per-developer identifier, the name the user chooses to share, and either the user’s email or a Hide My Email relay address.	Ireland (EEA controller); Apple Inc. in the US	Apple is an independent controller for the sign-in. Apple’s Privacy Policy (updated 2025-07-30) says EEA transfers are governed by SCCs.	Privacy Policy · Sign in with Apple & Privacy
Backend hosting for accounts, teams and billing	The database and API that hold users, organisations, memberships, subscriptions, entitlements, device records and the audit log	All account and team data listed in the Privacy Policy § 4.1 to 4.4	Decision pending. `docs/AUTH-AND-BILLING.md` § 4.1 recommends Vercel Functions + Neon Postgres in EU regions and advises against a home-connected server for a payment system. The brief for this draft says the backend may start self-hosted by BAARS DESIGN in Norway. Either way the row is filled in before launch.	If self-hosted by BAARS DESIGN in Norway: no subprocessor, no transfer. If Vercel/Neon: their DPAs (SCCs; Vercel, Inc. and Neon, Inc. are US companies with EU regions).	Vercel DPA · Neon platform terms, DPA section
Website host and contact-form storage	Serves the website and stores contact-form submissions before they are emailed to us	Visitor IP addresses in access logs; contact-form name, email, company, message	Decision pending. `baars.design` is on Vercel today (response header `server: Vercel`, 2026-10-30), with no cookies set on the home page.	Vercel DPA (SCCs) if Vercel.	Vercel DPA

Under consideration (Enterprise tier only)

Provider	Purpose	Data	Location	Transfer mechanism	Links
WorkOS, Inc.	Single sign-on (SAML/OIDC) and directory sync (SCIM) for Enterprise organisations that ask for it	Employee identifiers, emails, names and group membership sent by the customer’s identity provider	United States	WorkOS DPA (SCCs). Added per customer, with that customer’s agreement, when the first Enterprise deal needs it.	DPA

Not subprocessors

These services receive data from the user’s Mac because the user chose them. BAARS DESIGN does not engage them and is not the controller for that data.

Service	Why it is listed	Links
Anthropic (Claude Code CLI, Anthropic API)	The user’s own AI engine; prompts and code go from the Mac to Anthropic under the user’s own account	Privacy · Consumer terms
OpenAI (Codex CLI, OpenAI API)	Same, for OpenAI	Privacy
Google (Gemini CLI, Gemini API)	Same, for Google	Gemini API terms
GitHub (the user’s account and repositories)	Repositories, branches and pull requests are the user’s; the app uses the user’s own GitHub token and GitHub CLI. The only BAARS DESIGN-side relationship with GitHub is the release feed in the table above and the Something GitHub App registration.	Privacy Statement · Terms

Lawyer: whether the Something GitHub App (through which users grant repository access and whose client id the app carries) makes BAARS DESIGN a controller for the installation metadata GitHub holds about it. The app’s own servers receive no repository data; the token stays on the Mac.

Change log

Date	Change
2026-10-30	First draft.

Verification record (2026-10-30)

Link status: all URLs above returned HTTP 200 (after redirects) to curl -L, except the GitHub DPA (HTTP 500 twice; content read through a fetch tool; version “October 2025” confirmed there). Raw results in legal-linkcheck.txt next to this folder.
Oracle: dig MX baars.design → mail.baars.design → 144.21.40.114; RIPE RDAP for that address: netname ORACLE-PT, registrant Oracle Svenska AB, remarks “Oracle Corporation, Redwood Shores”. Region eu-amsterdam-1 is from BAARS DESIGN/admin/accounts-and-services.md (2026-08-10). A whois lookup over port 43 stalled from this Mac (Zscaler blocks non-HTTPS protocols), which is why RDAP over HTTPS was used.
Supabase subprocessor PDF: https://supabase.com/legal/subprocessor-list/October-12-2026.pdf, read with pdftotext.
Stripe: Services Agreement table lists Norway under “Stripe Payments Europe, Limited”; DPA dated 28 September 2026; Privacy Center FAQ “Is Stripe certified under the EU-U.S Data Privacy Framework?” answers that “Stripe, LLC is certified under the EU-U.S DPF, Swiss-U.S. DPF and the UK Extension”.
Telemetry: none in the app (see Privacy Policy sources). The only outbound hosts in app code are github.com, api.github.com, api.openai.com, generativelanguage.googleapis.com and Anthropic’s API through its SDK.