Every third party that processes anything for the Mirror operator or this site, what it processes, and where. Changes are published here at least 30 days before a new sub-processor is used (a proposed term; see contract schedules).
| Sub-processor | Service | What it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Workers (the edge in front of the operator), a Durable Object (the operator itself), Pages (this site), rate limiting, the webhook retry trigger | Every API request and response: commitments, signatures, governance events, webhook deliveries. The raw-data wall means no trade value, band, secret or customer identifier reaches it through Mirror. It also serves this site's static files. | Processing: the EU. The operator runs in a Durable Object restricted to Cloudflare's EU jurisdiction, observed at runtime and signed at GET /residency. The edge that first receives a request can be anywhere; it forwards the request unread. Cloudflare also logs object ids outside the EU. This site is served from Cloudflare's global network. |
| Supabase, Inc. (on Amazon Web Services) | Postgres database: the operator's durable store | Governance events, member public keys, signed verdicts, pKYC trigger commitments, webhook subscriptions and the delivery outbox. Every Mirror table has row-level security on and is reachable only with the service role. | AWS eu-central-1 (Frankfurt) |
Facts a diligence review should know#
- The database project is shared. It also hosts tables for another product by the same maintainer. Mirror's tables (
mirror_*) are separate, with row-level security and no grants to anonymous or authenticated roles. A dedicated project per production deployment is the recommended configuration. - Backups. The store follows Supabase's backup regime for the project's plan. The maintainer has not published the plan's backup and point-in-time-recovery settings here. Confirm them before relying on a recovery-point objective (see RTO / RPO).
- An alternative host. The operator can also run as a Supabase Edge Function, which Supabase processes in its edge regions. That host is not pinned to the EU, and its own
GET /residencysays so. The public operator URL is the Cloudflare Worker. - The site loads nothing from any other host. Its content-security policy is
default-src 'none'with same-origin scripts, styles and fonts; there are no analytics, no third-party fonts and no trackers. - Inside a bank, there is no sub-processor. The bander runs on the bank's machines with no network. A custody tool it calls (an HSM or a cloud KMS) is the bank's own processor, under the bank's contract.