This is the canonical list. When you add a vendor, add a row here
and update the subprocessor list
on the trust site.
| |
|---|
| Use | Core compute (Cloud Run), database (Cloud SQL), secrets (Secret Manager), CI (Cloud Build), artifact registry, KMS, Cloud Storage, uptime monitoring |
| Projects | tappass-prod, tappass-staging |
| Console | console.cloud.google.com |
| Account owner | Jens (Organization Admin) |
| Billing | Linked to tappass.ai billing account |
| DPA status | Cloud DPA — auto-accepted on sign-up |
| Blast radius if down | Entire platform down (app + DB + auth). SEV1 |
| Recovery | No practical single-vendor failover — multi-region within europe-west is the tier we plan for. See Infrastructure |
| |
|---|
| Use | DNS, WAF, edge cache in front of Cloud Run, Pages hosting for tappass.ai, docs, internal-docs, trust; Cloudflare Access gates internal-docs |
| Account | Pro plan, owner: Jens |
| Console | dash.cloudflare.com |
| DPA status | Cloudflare DPA — signed |
| Blast radius if down | Marketing site + docs go down; app is partially degraded (DNS-only, grey cloud) so eu.tappass.ai may survive CF control-plane outages |
| Recovery | DNS is the most critical CF dependency; TTLs are 300s so failover would take 5–10min even with ready backup records |
| |
|---|
| Use | Application error tracking + performance traces, frontend (React SDK) + backend (Python SDK) |
| Projects | tappass-backend + tappass-frontend (prod) and staging-tappass-backend + staging-tappass-frontend (staging) — split documented here |
| Host | o4511252151795713.ingest.de.sentry.io (EU region) |
| Console | sentry.io |
| DSN storage | Secret Manager (tappass-sentry-dsn, tappass-sentry-dsn-frontend) in each GCP project |
| DPA status | Signed, EU data residency |
| Blast radius if down | We lose error telemetry — the app keeps serving. No user-facing impact |
| Recovery | Wait; Sentry outages are typically <1h and we don't gate on Sentry availability |
| |
|---|
| Use | Product analytics, session recordings (frontend), feature flags |
| Host | eu.i.posthog.com (EU region) |
| Console | eu.posthog.com |
| API key | Public phc_* token — baked into index.html at request time |
| DPA status | Signed, EU data residency |
| Blast radius if down | We lose product analytics + feature flags. Flag evaluation falls back to default variant (already tested fallback path) |
| |
|---|
| Use | Transactional email — agent onboarding, invites, password reset, policy digests |
| From domain | noreply@tappass.ai + privacy@tappass.ai (DKIM verified) |
| Console | resend.com |
| API key | Secret Manager (tappass-resend-api-key) per project |
| DPA status | Resend DPA — signed |
| Blast radius if down | New-user onboarding emails don't land — fire-and-forget path means the onboard itself succeeds and credentials are shown in-UI. See the demo-day incident for why we isolated this |
| Recovery | Resend maintains ≥99.9% uptime historically. If extended outage, fallback is to manually resend via /api/admin/resend-invite once Resend recovers |
These are technically customer-brought keys, not vendors of ours —
but they're on the runtime data path so downtime affects users.
| Provider | Region | Console | Failure mode |
|---|
| Anthropic | US (EU plan available) | console.anthropic.com | Circuit breaker in gateway → returns 503 with actionable retry_after |
| OpenAI | US | platform.openai.com | Same |
| Azure OpenAI | Customer-owned | Azure portal | Same |
| Google Gemini | US / EU | Vertex AI console | Same |
| AWS Bedrock | Multi-region | AWS Console | Same |
The gateway tracks per-provider circuit state — see
tappass/gateway/circuit_breaker.py.
| |
|---|
| Use | Human-accessible secret vault (AWS root, CF root, prod break-glass) |
| Vaults | TapPass / Engineering, TapPass / Operations, TapPass / Legal |
| Owner | Jens (Owner) — every admin has full rights to Engineering+Operations vaults |
| |
|---|
| Use | Issue tracking, roadmap |
| Sentry integration | Issues route from Sentry → Linear with SHA context |
| Owner | Jens |
Subprocessor list is the canonical customer-facing view of this
page. When a vendor is added here, it must also be added on
trust.tappass.ai/subprocessors
within 30 days per DPA obligations.
Primary contact for every vendor is Jens (until we grow). Secondary:
| Vendor | Secondary | Reason |
|---|
| GCP | Jonathan | Infrastructure co-admin |
| Cloudflare | Jonathan | DNS + Pages deploy fallback |
| Sentry / PostHog | n/a | Low criticality |
| Resend | n/a | Transactional only |
| GitHub | Jonathan | Deploy + release workflow access |
If a vendor goes down during an incident, see
Incident response — the vendor triage belongs
in the status doc timeline so postmortems capture it.
Any new SaaS that:
- Processes customer personal data (becomes a subprocessor), or
- Is on the request path (a failure affects users), or
- Holds our secrets or infrastructure state.
Analytics-only or internal-only tools (Figma, Notion-equivalents)
don't need a row unless they cross one of the three bars.
