SUBPROCESSOR AND TRANSFER REGISTER

Cloudflare — public website and portal infrastructure, Workers, Access, protective network services, database and object storage according to active configuration. The exact contracting entity, location, role, DPA and any transfer mechanism are recorded in the agreement and supplier register applicable to the service. Primary Client document and database storage is configured for EU jurisdiction, while global network and support flows may require appropriate safeguards.

BEIT or another integration recipient — engaged only when expressly named in the Order or an approved handoff. Before any production transfer, the exact legal entity, country, contacts, purpose, controller/processor role, security terms, DPA or other appropriate agreement and minimised data manifest must be documented. No production personal data is transferred until these conditions are met.

Any additional email, monitoring, support, analytics or identity provider is added to the public register before use with production personal data. The record states legal entity, country, purpose, data categories, location, subcontractors, transfer instrument, start date and change-notice method. Development tools without production data are maintained separately in the internal supplier register.

HouseID maintains a public change date and subscription mechanism. A new subprocessor is not engaged before due diligence, Article 28 terms, transfer assessment and 30-day notice, except a security emergency. Emergency use is documented, notified promptly and limited in duration and data.