Subprocessors
Every third party that processes data on EcoKure’s behalf. Compiled by reading what the code actually calls, not from memory — a subprocessor list assembled from recollection is the one that misses something.
| Subprocessor | Purpose | Location | What it can see | Where it appears |
|---|---|---|---|---|
| Railway | Application hosting and PostgreSQL | United States | Serves the site and stores application data. | railway.json, Procfile, psycopg2 |
| Cloudflare | DNS, CDN and TLS termination | Global edge | Routes requests. Sees request metadata in transit. | domain configuration |
| Plausible Analytics | Website analytics | European Union | Aggregate page views. No cookies, no cross-site tracking, no personal identifiers. | templates/base.html |
| Sentry | Application error monitoring | United States | Receives stack traces when the application errors. May incidentally include request context. | sentry-sdk in requirements.txt |
| Stripe | Payment processing | United States | Handles card data directly. EcoKure never receives card numbers. | stripe in requirements.txt |
| Printful | Merchandise fulfilment | United States / Europe | Receives name and delivery address for physical orders only. Not involved in any assurance workflow. | api.printful.com |
| GitHub | Source hosting and the public verifier | United States | Hosts public repositories and the independently runnable evidence verifier. | kyal102.github.io |
The Assurance Runtime has no subprocessors. The list above covers this website. The enterprise runtime deploys inside the customer’s own account: evidence, signing keys and decision records never leave their boundary, and no third party on this page touches them. The two are separate systems and should not be conflated in a vendor assessment.
Data processing agreement
An outline exists and has not been legally reviewed. It is
an engineering description of what we do with data and what a DPA would
therefore have to say — not a contract. We would rather tell you that
than hand over a document implying a legal review that never happened.
Two points need resolving before anyone signs. Deletion: an
append-only evidence chain cannot delete in the ordinary sense, and we will
not describe cryptographic erasure as deletion. Security
warranty: we hold no SOC 2, no ISO 27001 and no independent
penetration test, and will not imply otherwise.