# Sub-processors

Every third party that processes anything for the Mirror operator or this site, what it processes, and where. Changes are published here at least 30 days before a new sub-processor is used (a proposed term; see [contract schedules](/contract-schedules.md)).

| Sub-processor | Service | What it processes | Location |
|---|---|---|---|
| **Cloudflare, Inc.** | Workers (the edge in front of the operator), a Durable Object (the operator itself), Pages (this site), rate limiting, the webhook retry trigger | Every API request and response: commitments, signatures, governance events, webhook deliveries. The raw-data wall means no trade value, band, secret or customer identifier reaches it through Mirror. It also serves this site's static files. | **Processing: the EU.** The operator runs in a Durable Object restricted to Cloudflare's EU jurisdiction, observed at runtime and signed at `GET /residency`. The edge that first receives a request can be anywhere; it forwards the request unread. Cloudflare also logs object ids outside the EU. This site is served from Cloudflare's global network. |
| **Supabase, Inc.** (on Amazon Web Services) | Postgres database: the operator's durable store | Governance events, member public keys, signed verdicts, pKYC trigger commitments, webhook subscriptions and the delivery outbox. Every Mirror table has row-level security on and is reachable only with the service role. | AWS **eu-central-1 (Frankfurt)** |

## Facts a diligence review should know

- **The database project is shared.** It also hosts tables for another product by the same maintainer. Mirror's tables (`mirror_*`) are separate, with row-level security and no grants to anonymous or authenticated roles. A dedicated project per production deployment is the recommended configuration.
- **Backups.** The store follows Supabase's backup regime for the project's plan. The maintainer has not published the plan's backup and point-in-time-recovery settings here. Confirm them before relying on a recovery-point objective (see [RTO / RPO](/rto-rpo.md)).
- **An alternative host.** The operator can also run as a Supabase Edge Function, which Supabase processes in its edge regions. That host is **not** pinned to the EU, and its own `GET /residency` says so. The public operator URL is the Cloudflare Worker.
- **The site loads nothing from any other host.** Its content-security policy is `default-src 'none'` with same-origin scripts, styles and fonts; there are no analytics, no third-party fonts and no trackers.
- **Inside a bank, there is no sub-processor.** The bander runs on the bank's machines with no network. A custody tool it calls (an HSM or a cloud KMS) is the **bank's** own processor, under the bank's contract.