REGS privacy notice

Suppliers and verification status

15/10/2026

Supabase

Database, authentication and files. Database in Germany does not mean exclusively EU processing. Reserved-role audit and contract/transfer checks remain open.

Supplier public terms

Vercel

Application, APIs and workflows; data in transit and technical logs. Execution locations, access and applicable safeguards must be completed before customer use.

Supplier public terms

Zernio

Optional Meta and WhatsApp bridge. Contractual chain, individual erasure and residual-copy handling remain under review. No Production customer connection is active.

Supplier public terms

Resend

Operational and authentication email; sending configured in Ireland, declared primary operations in the USA. DPA incorporation at signup verified; individual procedures and transfer assessment remain to be completed.

Supplier public terms

Google Workspace / Drive

Private business destination for encrypted backups. Addendum accepted by the owner; this does not prove exclusively EU processing or removal of all external copies. Calendar requires separate agency authorisation.

Supplier public terms

GitHub Actions

Build/test and technical backup job. The runner may read data before encryption: contractual coverage, workload, locations and residual copies require clarification before real data.

Supplier public terms

OpenAI API

Optional AI assistance with minimised data. Contracting entity, endpoint, retention and safeguards require verification before real data; no Zero Data Retention or personal ChatGPT-account claim.

Supplier public terms

This transparency sheet is not an agency's final Annex C and does not authorise transfers. The agency dossier must identify actual services, entities, countries and verified safeguards. For relevant information and safeguards: office@azionedigitale.com.