Subprocessors
Infrastructure providers used by the current public service.
This operational list reflects verified deployment use as of 9 August 2026. Contractual roles, notice periods, and customer-specific scope belong in the applicable DPA.
| Provider | Purpose | Data scope | Location statement |
|---|---|---|---|
| Vercel | Public marketing website hosting and delivery | Website request and delivery metadata | Provider-controlled locations |
| Railway | Customer console, provider API, identity runtime, and PostgreSQL infrastructure | Account, organization, API operation, and service data as required by the deployed component | Provider-controlled configured regions |
| GitHub | Source control and continuous integration | Source code and CI metadata; no production customer payloads are intentionally used as fixtures | Provider-controlled locations |
No provider relationship listed here implies ZATCA, SPL, CST, or other government approval. No blanket data-residency claim is made.