konnospage.tsx157 lines · main
| 1 | export const metadata = { title: 'subprocessors' }; |
| 2 | |
| 3 | interface Subprocessor { |
| 4 | name: string; |
| 5 | purpose: string; |
| 6 | location: string; |
| 7 | status: 'active' | 'planned'; |
| 8 | notes?: string; |
| 9 | } |
| 10 | |
| 11 | const SUBPROCESSORS: readonly Subprocessor[] = [ |
| 12 | { |
| 13 | name: 'Hostinger International Ltd.', |
| 14 | purpose: 'VPS hosting (compute, bandwidth, host disk for control + data plane)', |
| 15 | location: 'Lithuania (HQ); Frankfurt, Germany (data centre)', |
| 16 | status: 'active', |
| 17 | notes: |
| 18 | 'Customer Postgres, runtime isolates, backups, and the dashboard all run on a Hostinger KVM in Frankfurt.', |
| 19 | }, |
| 20 | { |
| 21 | name: "Let's Encrypt (Internet Security Research Group)", |
| 22 | purpose: 'Issuance of TLS certificates for briven.tech and its subdomains', |
| 23 | location: 'United States (CA-domiciled)', |
| 24 | status: 'active', |
| 25 | notes: |
| 26 | 'No personal data is shared beyond the public domain name being certified. Renewals are automatic via ACME.', |
| 27 | }, |
| 28 | { |
| 29 | name: 'mittera.eu', |
| 30 | purpose: 'Transactional email delivery (magic-link sign-in, email verification, project invitations, account notices)', |
| 31 | location: 'EU (operator-controlled)', |
| 32 | status: 'planned', |
| 33 | notes: |
| 34 | "Sister product to briven, also operated by the briven Operator. Outbound sends authenticate with a Bearer API key (POST https://api.mittera.eu/api/v1/emails); delivery / bounce / complaint events come back to https://api.briven.tech/mittera-webhook signed with HMAC-SHA256 of `${ts_ms}.${body}` and verified against BRIVEN_MITTERA_WEBHOOK_SECRET. Until BRIVEN_MITTERA_API_URL and BRIVEN_MITTERA_API_KEY are configured, magic-link emails print to the api container stdout for first-user bootstrap.", |
| 35 | }, |
| 36 | { |
| 37 | name: 'Polar Software Inc.', |
| 38 | purpose: 'Subscription billing, checkout, invoicing, taxation', |
| 39 | location: 'United States; EU-resident processors via Stripe Connect', |
| 40 | status: 'planned', |
| 41 | notes: |
| 42 | 'Activated when paid tiers launch. Polar handles all card data; no card details ever touch briven infrastructure.', |
| 43 | }, |
| 44 | { |
| 45 | name: 'Backblaze, Inc. (B2 Cloud Storage)', |
| 46 | purpose: 'Off-site encrypted backup storage for nightly Postgres dumps', |
| 47 | location: 'United States; EU mirror available', |
| 48 | status: 'planned', |
| 49 | notes: |
| 50 | 'Encryption keys remain on briven infrastructure; B2 receives only ciphertext. EU mirror selected when activated.', |
| 51 | }, |
| 52 | { |
| 53 | name: 'Codeberg (codeberg.org)', |
| 54 | purpose: 'Source code hosting; CI artifact storage', |
| 55 | location: 'EU (operator-controlled)', |
| 56 | status: 'active', |
| 57 | notes: |
| 58 | 'No customer data flows to Codeberg. Public source only. Listed for transparency about where the briven codebase lives.', |
| 59 | }, |
| 60 | { |
| 61 | name: 'Google Cloud (Google LLC)', |
| 62 | purpose: 'OAuth identity (Sign in with Google)', |
| 63 | location: 'United States; EU points of presence', |
| 64 | status: 'planned', |
| 65 | notes: |
| 66 | 'Engaged only if you choose to sign in via Google. We receive your name, email, and avatar URL; we send Google nothing about your briven activity.', |
| 67 | }, |
| 68 | ]; |
| 69 | |
| 70 | export default function SubprocessorsPage() { |
| 71 | return ( |
| 72 | <> |
| 73 | <h1 className="font-mono text-2xl text-[var(--color-text)]">subprocessors</h1> |
| 74 | <p className="mt-2 font-mono text-xs text-[var(--color-text-subtle)]"> |
| 75 | last updated 2026-05-10 · phase 0 private alpha |
| 76 | </p> |
| 77 | |
| 78 | <p className="mt-8"> |
| 79 | This page lists every third-party service that processes briven Customer data on behalf |
| 80 | of <strong>flndrn Limited</strong> (the Operator), a company registered at Arch. Makariou |
| 81 | III 171, Vanezis Business Center 4th floor, 3027 Limassol, Cyprus. Where a subprocessor |
| 82 | is “planned”, the integration exists in code but is disabled until the |
| 83 | corresponding configuration is provided; we list them here so you can audit what your |
| 84 | account will be exposed to as features turn on. |
| 85 | </p> |
| 86 | |
| 87 | <p className="mt-4"> |
| 88 | Each subprocessor is engaged under a data-processing agreement that limits them to the |
| 89 | purpose stated below. Transfers outside the EU rely on Standard Contractual Clauses with |
| 90 | appropriate supplementary measures (TLS in transit, AES-256 at rest, minimisation of |
| 91 | what we send to each processor). |
| 92 | </p> |
| 93 | |
| 94 | <div className="mt-10 overflow-x-auto"> |
| 95 | <table className="w-full min-w-[640px] border-collapse font-mono text-xs"> |
| 96 | <thead> |
| 97 | <tr className="border-b border-[var(--color-border)] text-left text-[var(--color-text-muted)]"> |
| 98 | <th className="py-2 pr-4 font-medium">subprocessor</th> |
| 99 | <th className="py-2 pr-4 font-medium">purpose</th> |
| 100 | <th className="py-2 pr-4 font-medium">location</th> |
| 101 | <th className="py-2 pr-4 font-medium">status</th> |
| 102 | </tr> |
| 103 | </thead> |
| 104 | <tbody> |
| 105 | {SUBPROCESSORS.map((sp) => ( |
| 106 | <tr |
| 107 | key={sp.name} |
| 108 | className="border-b border-[var(--color-border-subtle)] align-top" |
| 109 | > |
| 110 | <td className="py-3 pr-4 text-[var(--color-text)]">{sp.name}</td> |
| 111 | <td className="py-3 pr-4 text-[var(--color-text-muted)]"> |
| 112 | {sp.purpose} |
| 113 | {sp.notes ? ( |
| 114 | <span className="mt-1 block text-[var(--color-text-subtle)]">{sp.notes}</span> |
| 115 | ) : null} |
| 116 | </td> |
| 117 | <td className="py-3 pr-4 text-[var(--color-text-muted)]">{sp.location}</td> |
| 118 | <td className="py-3 pr-4"> |
| 119 | {sp.status === 'active' ? ( |
| 120 | <span className="inline-flex rounded-md bg-[var(--color-primary-subtle)] px-2 py-0.5 text-[var(--color-primary)]"> |
| 121 | active |
| 122 | </span> |
| 123 | ) : ( |
| 124 | <span className="inline-flex rounded-md bg-[var(--color-surface-raised)] px-2 py-0.5 text-[var(--color-text-subtle)]"> |
| 125 | planned |
| 126 | </span> |
| 127 | )} |
| 128 | </td> |
| 129 | </tr> |
| 130 | ))} |
| 131 | </tbody> |
| 132 | </table> |
| 133 | </div> |
| 134 | |
| 135 | <h2 className="mt-12 font-mono text-lg text-[var(--color-text)]"> |
| 136 | change-notification policy |
| 137 | </h2> |
| 138 | <p> |
| 139 | We will publish material changes to this list at least 30 days before a new subprocessor |
| 140 | starts processing customer data. “Material” means: adding a subprocessor, |
| 141 | replacing one with a substantively different service, or expanding the scope of an |
| 142 | existing subprocessor’s access to a category of data not previously covered. |
| 143 | Notifications appear on briven.tech/changelog and are emailed to account owners. |
| 144 | </p> |
| 145 | <p className="mt-3"> |
| 146 | If a subprocessor change is unacceptable for your use case, you may close your account |
| 147 | and export your data without penalty within 30 days of the notice. |
| 148 | </p> |
| 149 | |
| 150 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">questions</h2> |
| 151 | <p> |
| 152 | Contact <strong>privacy@flndrn.com</strong> for any subprocessor-related question, including |
| 153 | requests for the underlying data-processing agreements where they are not publicly available. |
| 154 | </p> |
| 155 | </> |
| 156 | ); |
| 157 | } |