Sub-processors — Draft

Every entry below is either confirmed (found directly in this codebase — an API endpoint it calls, an env var it reads, a deployment config it ships with) or marked [TAHMİN — patron doğrula] (a reasonable inference this page’s author could not independently confirm). Nothing below is invented; a confirmed entry is not the same as a legally-vetted sub-processor list, and this list has not yet been reviewed by counsel.

• Railway — application hosting / compute. Confirmed: this app deploys via a Railway-specific build config (railway.toml, Dockerfile) and reads a Railway-injected commit SHA at runtime.
• Resend — transactional email delivery (console sign-in magic links, enterprise invitations). Confirmed: the code calls api.resend.com directly when an API key is configured. Only active when an operator has configured RESEND_API_KEY and a from-address; without it, no email provider is called (an internal, non-production-reachable fallback path is used instead).

• Database hosting — [TAHMİN — patron doğrula] likely Railway’s own managed Postgres, since the app already deploys on Railway and the operations runbook describes “provider-managed encrypted Postgres backups.” The connection string is a generic environment variable in this codebase, so the exact hosting provider is not confirmable from code alone.

• No push-notification service (e.g. FCM, APNs) is integrated in this codebase as of this writing — the mobile app uses local, on-device notifications only.
• No analytics, advertising, or session-recording tracker of any kind was found in this codebase.
• No payment/billing processor is integrated in this codebase.

A signed Data Processing Agreement listing sub-processors contractually is not yet published. See /privacy. Contact toratoraman@gmail.com for enterprise DPA requests. [TODO: patron/hukuk-ekibi doldurur]