Draft, not for publication. Items shaded like [GAP: example] are unknown and need a source or a decision. This page is hidden from search engines until they are closed.
Digital Sovereignty Audit applied to ourselves
The services behind the Exposure Snapshot
Digital Sovereignty Audit helps organisations see which US-controlled software and cloud services they depend on. It would be odd to ask that of others and say nothing about ourselves, so this page lists the providers that handle data for the free Exposure Snapshot, in the same terms we use for a client: who provides the service, who owns the provider, and where the service runs.
Our position is awareness, not avoidance. We chose these providers on merit and we use US-owned services knowingly. Knowing is the point: you can only weigh a dependency you can see.
What we use
| Provider | Used for | Company | Jurisdiction | Where our data sits |
|---|---|---|---|---|
| Cloudflare | Content delivery, firewall, bot protection (Turnstile) | Cloudflare, Inc. | US | Global network. Customer logs can be kept in the EU only if a metadata boundary is configured. [GAP: confirm whether we configure it] |
| Railway | Runs the application | Railway Corporation | US (San Francisco). [GAP: state of incorporation not verified] | EU West |
| Supabase | PostgreSQL database | Contract with Supabase Pte. Ltd (Singapore). Supabase, Inc. (US, Delaware) is in the group and provides support. [GAP: ownership link between the two not confirmed from a primary source] | Singapore (contracting entity); US (Supabase, Inc.) | Frankfurt (hosting is on Amazon Web Services) |
| Amazon Web Services (SES) | Sending the link email | Amazon.com, Inc. | US | eu-central-1 (Frankfurt) |
Supabase's own hosting runs on Amazon Web Services, so two of the four rows rest on the same underlying cloud. Provider support staff outside the EU may be able to access data in some circumstances. Our privacy notice sets out the transfer safeguards. [GAP: link to the privacy notice section once the safeguards are named]
Evidence
- Cloudflare: Cloudflare trust hub (GDPR page) and the Customer Metadata Boundary documentation, accessed 21 October 2026. Relies on the EU-US Data Privacy Framework with standard contractual clauses as the fallback.
- Amazon Web Services: AWS data processing addendum page, accessed 21 October 2026. Standard contractual clauses are incorporated; the page does not mention Data Privacy Framework certification.
- Railway: company profiles on Crunchbase and PitchBook give the legal name Railway Corporation and a San Francisco office, accessed 21 October 2026. These are third-party sources. [GAP: confirm against Railway's own terms and data processing addendum]
- Supabase: its data processing addendum and transfers FAQ name Supabase Pte. Ltd (Singapore) as the contracting party and Supabase, Inc. (US) as the provider of support. Its sub-processor list of 1 June 2026 names Amazon Web Services for hosting. Third-party sources (Crunchbase, an SEC Form D summary) place Supabase, Inc. in Delaware and San Francisco. Accessed 21 October 2026, through search results rather than the pages themselves. [GAP: read the primary pages directly and confirm]
The Cloudflare and Amazon entries come from our catalogue, where they are marked as not yet reviewed by a maintainer. [GAP: review both before publishing, or keep this sentence]
What this page does not say
- It lists observed facts. It does not give an audit score and makes no judgement about any provider.
- It covers the free Exposure Snapshot only. It is not a statement about how we run the rest of the company.
- It is technical information, not legal advice, and reaches no conclusion about the lawfulness of any transfer.
See also the privacy notice.