Draft, 26 October 2026. Items marked verify must be checked against Google's and each supplier's current documentation and data processing terms when the projects are created. This service does not claim UK-only residency.
| Supplier | Purpose | Customer data involved | Primary location | Notes |
|---|---|---|---|---|
| Google Cloud / Firebase: Firestore | Database | All case records | London, europe-west2 | Location fixed at creation |
| Google Cloud / Firebase: Cloud Storage | Documents | Uploaded files, imported emails | London, europe-west2 | Bucket location chosen at creation |
| Google Cloud / Firebase: Authentication with Identity Platform | Sign-in, TOTP | Email, password hash, display name, sign-in metadata | Global service; verify where Identity Platform stores user records | Likely outside the UK |
| Google Cloud Functions and Cloud Run | Audit trigger, malware scanning (ClamAV) | Case metadata; files during scanning | London, europe-west2 | |
| Google Cloud Logging | Platform and function logs | Request metadata, our structured logs (no bodies) | verify log bucket region; can be set to europe-west2 | |
| Vercel | App hosting | Requests in transit; request logs | Functions in London (lhr1); edge global; logs primarily US |
Logs exclude bodies by design |
| Backblaze | Off-Google backups | Encrypted copies | EU Central (Amsterdam) | Encrypted before upload |
| Resend | Invitation, reminder and notice emails | Recipient, links, task titles in reminders | US by default; verify EU option | No case content is emailed |
| Sentry (planned, not yet integrated) | Error monitoring | Scrubbed stack traces, user ID | verify EU region | Structured logs to Vercel are used until then |
| Google (Gmail API) | Mailbox connections | Selected messages, OAuth tokens | Global | Only where a user connects a mailbox |
| Stripe | Billing | Billing details | US and Ireland | Card data never touches our systems |
| GitHub | Source code and CI | Fictional test data only | US |
Firebase Authentication emails (verification, password reset) are sent by Google, from the project's own domain unless custom SMTP is configured.