Trust · Subprocessors
A final subprocessor inventory is not published yet.
GitHub, Cloudflare, Supabase and Google Cloud appear in the governed technical stack, but that does not by itself establish their contractual role, data scope or processing location for every One Lab service.
01 / Trust · Subprocessors
What remains to be reconciled
The final inventory needs each provider's legal entity, purpose, service scope, data categories, processing locations and transfer basis.
02 / Trust · Subprocessors
No placeholder becomes a claim
One Lab will not label a vendor a subprocessor—or omit one—based only on architecture documentation. The legal configuration and actual production data flows must agree before publication.
03 / Trust · Subprocessors
Infrastructure is not contract interpretation
A provider can appear in source code, CI or a deployment plan without processing the same data for every product. The final list must be product- and role-specific.