Legal
Sub-processors
Five services, what each one receives, and which side of the Atlantic it runs on. If you are doing a vendor review, this is the page you were going to email me for.
Last updated: 7 September 2026
1 · The list
| Service | What it does | What reaches it | Where |
|---|---|---|---|
| Neon | Managed PostgreSQL — the database behind the site | Everything stored: names, email addresses, messages, conversations, IP addresses | United States (aws-us-east-2) |
| Railway | Application hosting | All traffic. IP addresses appear in server logs. | United States |
| OpenAI | The language model behind the AI agent | The messages you send the agent, verbatim, and the project summary it builds | United States |
| MailerSend | Notification email when someone gets in touch | Your name, email address and message | European Union |
| PostHog | Analytics and session recording — only with consent | Page views, a small number of named actions, and session replays if enabled | European Union |
2 · The two that will come up in review
The database is in the United States. That is a transfer out of the European Economic Area, made on the provider's standard contractual clauses. It is stated here rather than left for you to discover, because it is the first thing a reviewer looks for.
What a visitor types to the AI agent reaches OpenAI, on every turn, because that is what makes the agent answer. There is no way to run a hosted model without this being true, and any vendor claiming otherwise is describing a different architecture. The agent is instructed never to ask for credentials or confidential material, and the site says so where people type.
3 · Analytics is the only optional one
PostHog receives nothing at all unless a visitor switches analytics on, and session recordings only if they separately switch those on. Every other service on this list is load-bearing — remove it and the site stops working.
4 · Changes
A service is added to this list the day it is wired up, not the day somebody notices. The date at the top moves with it.
5 · Data processing agreements
On this website I am the controller, so there is no DPA to sign for reading it. For client work it is the other way round — I am usually the processor, and a DPA is part of the engagement rather than something published in advance. A generic one posted here would be either unsigned or signed without reading, and neither is worth having.
Ask at privacy@iambogdan.com and one gets drafted against the actual scope.