Canonical source draft
Data Processing And Subprocessors
This document names the intended data-processing boundaries for RadiantOS. Legal counsel must review customer-facing contracts before launch.
Subprocessor Map
| Subprocessor | Purpose | Data categories |
|---|---|---|
| Vultr | US/EU Vultr VKE/container runtime, managed database, Vultr Archival Object Storage, regional infrastructure | Customer operational data, tenant database records, backups, exports, recordings, logs depending on region |
| Stripe | Billing, invoices, tax, payment method references, customer portal | Billing contact, invoice, tax and payment metadata |
| SendGrid | Transactional email, inbound ticket email, delivery events | Email address, message metadata, transactional content where sent |
| Sentry | Error, performance and release evidence | Scrubbed error context, release version, tenant/context IDs |
| PostHog | Product analytics and training-gap analysis | Privacy-safe events, masked replay where enabled |
| Microsoft | Microsoft Cloud and M365 backup/management where connected | Provider tenant data under customer consent |
| Google Workspace backup where connected | Provider tenant data under customer consent |
Processing Rules
- Vault secret values, provider tokens and payment card data are not sent to PostHog, Sentry or SendGrid logs.
- Session replay is disabled on vault, credential, payment, ticket body and sensitive admin screens unless an approved masking rule exists.
- Customers must be able to see connected providers and disconnect them.
- Data residency follows the tenant region except for approved global metadata and subprocessors that require global handling.
Contract Readiness
Customer contracts need DPA, subprocessor list, breach notice policy, retention schedule, support access policy, deletion/offboarding policy and region availability language.
Standard Acceptance And Evidence
This document is not complete until the implementation proves:
- The described behavior exists in the relevant UI, API, worker, agent, mobile, extension or provider flow.
- Backend enforcement exists for auth, tenant scope, region, RBAC/ABAC, entitlement, billing state and audit where applicable.
- User-level QA evidence is recorded in qa-evidence-ledger.md for every customer-visible workflow.
- Sentry traces/breadcrumbs and PostHog events exist where the workflow is customer-facing or operationally important.
- Failure, retry, rollback, denial and cleanup behavior are tested or explicitly marked not applicable with owner approval.
- No launch-blocking defect remains open for this scope.