Legal
Subprocessor register
JForge Labs uses the vendors below to run RootsX. Effective 28 August 2026. This is the list the intake consent calls the Privacy Notice.
Current vendors
| Vendor | Service | Region | Data |
|---|---|---|---|
| DigitalOcean | App Platform, Managed PostgreSQL, Spaces | Canada | Application hosting, database, and file storage. Application data at rest, including participant records and uploaded files Region tor1 (Toronto). Spaces buckets are private. Downloads use time-limited signed URLs. |
| Cloudflare | DNS and HTTP edge | United States | Hostname resolution and the HTTP edge in front of DigitalOcean for rootsx.org, app.rootsx.org, and staging.rootsx.org. DNS queries and HTTPS requests. Live responses include Cloudflare proxy headers (server: cloudflare, cf-ray). Origin remains DigitalOcean in Toronto. Case files at rest are not stored on Cloudflare. |
| Resend | Transactional email | United States | Staff invites, password reset, and consent-link email. Email addresses and the content of those messages |
| Microsoft | Entra ID sign-in, optional Outlook calendar | United States | SEA staff sign-in via Microsoft 365, and optional consultant calendar sync. Staff email and name from Entra. Optional Outlook calendar tokens (encrypted at rest). Not used for participant case files. Shipped after the first draft of this register (PR #162). SEA tenant MFA applies if the organization requires it. |
| Anthropic | LLM completions with zero data retention | United States | Optional AI drafting of summaries and suggestions. A redacted, tokenized subset of case text plus a pseudonymous alias. Not sent unless the participant consents (or the organization turns the consent gate off). Zero Data Retention. Names, phones, emails, SINs, and similar identifiers are stripped before send. |
Changes
If we add a vendor that sees personal information, we will update this page and the Privacy Notice. Material changes to AI or cross-border processing also bump the intake consent version in the product. Questions: [email protected].