Vendor List & DPA Assessment

Scope of this list

This is an integration inventory for staging review, not a finalized subprocessor schedule. Contracting entities, selected regions, subprocessors, transfer terms and retention must be verified against the actual accounts before launch. A vendor name does not establish a certification, residency guarantee or completed DPA.

Connected services

Cloudflare: application hosting, static assets, background Workflows and scheduled dispatch; processes requests, job identifiers and operational metadata. Supabase: email/password authentication, account identities, workspace database and configured private evidence storage. Local database connection credentials remain outside Worker bindings.

Stripe: TEST checkout, portal, subscriptions, top-ups, invoices, cancellations, refunds and reconciliation. Card entry is hosted by Stripe; application records retain billing identifiers and credit state. DataForSEO: configured Maps, organic Search and AI scraping provider; receives task inputs such as queries, coordinates or provider location settings when an authorized call runs. Credentials alone do not enable paid work.

Resend: Supabase SMTP authentication mail and explicitly permitted report messages to verified recipients. Sentry: allowlisted operational incidents through the application monitoring hook when enabled. Management verification tokens remain local.

Google and AI platforms are underlying sources of provider-returned results, not automatically direct VIDIK360 account integrations. No direct Google Business Profile OAuth, Google Maps SDK, external tile service or separate direct AI-model API is active in the reviewed UI.

Commercial data and map licensing

DataForSEO publicly describes white-label AI data use in customer interfaces, dashboards and client deliverables, and its operational guidance supports storing retrieved results. Those statements support the intended analytics use case. They do not establish unrestricted raw-result resale, transfer third-party copyrights or settle every full-answer, evidence-export or redistribution use. Confirm the intended retained evidence and export scope against the actual contract before commercial release.

The current map is an inline coordinate plot without third-party tiles. Adding a tile, geocoding or Maps SDK provider requires a separate license, attribution, caching and privacy review. Source data, geographic assets and future providers must each be assessed; an unused mapping library does not supply data rights.

Is a DPA needed?

The service can process business-contact and workspace-user personal data, including material customers submit or receive in evidence. If VIDIK360 processes that information for a customer subject to processor-contract requirements, a customer DPA is likely needed. This is a preliminary assessment, not a legal conclusion about every customer or jurisdiction.

Before launch, counsel should map controller/processor roles, purposes and instructions; verify vendor DPAs and onward processors; define assistance with access/deletion requests, incidents and audits; agree security measures and deletion/return at termination; and assess any international transfers. No signed customer DPA or completed transfer assessment is claimed by this draft.