Legal
Subprocessor register
Living list of third parties that may process data for Bitsmith / Spear. Police tenant case data stays under tenant instructions (Bitsmith = processor). See also our privacy notice.
| Name | Purpose | Data (typical) | Region / notes | Contract |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Compute, storage, Mongo host EC2, S3 backups, Amplify hosting, contact form (Lambda, SES) | App data, logs, backups, static site | ap-south-1 (Mumbai) primary | AWS customer agreement |
| Cloudflare | DNS for bitsmith.tech | DNS queries, limited request metadata if proxied | Global edge; API DNS often DNS-only | Cloudflare ToS |
| Sentry | Error monitoring (relay) | Stack traces, request metadata, sendDefaultPii false | Sentry cloud (review region) | ToS / DPA as configured |
| OpenRouter | LLM routing for Spear AI (if enabled) | Prompts/completions may include operational text. Transfer controls under review | Varies by upstream model | Pending decision |
| Google (Firebase / FCM) | Gateway push / related mobile services | Device tokens, limited push metadata | Google cloud | Google terms |
| Namecheap | Domain registrar for bitsmith.tech | Registrant contact | Registrar | Registrar terms |
| Slack | Internal ops alerts | Alert text, infra digests. Avoid PII in alerts | Slack cloud | Workspace terms |
- On-prem BYOD tenants may keep case DB on their premises. Subprocessors above still apply to control-plane / SaaS components they use.
- This page does not list credentials or account IDs.
- Compliance in progress: we are actively finishing CERT-In operational readiness, DPDP privacy controls, and longer-track certifications (e.g. ISO / SOC 2) where they apply. Product seals are shown only after the matching work and evidence are complete. This register is transparency, not a certificate.