Draft for review. Full company particulars and outstanding policy and operational details must be finalised before these documents take effect.
LEGALService Providers and Sub-processors
Infrastructure, payments, AI and customer-selected data destinations.
1. What this register covers
This register describes the service-provider roles identified in the reviewed Onlyform implementation. It is a draft inventory, not a statement that every supported provider is enabled in production. The production provider's full contracting identity, countries of processing, contract/DPA, transfer mechanism and retention configuration must be confirmed before this becomes the contractual sub-processor schedule.
2. Infrastructure and communications
| Provider or function | Purpose and possible data | Deployment status |
|---|---|---|
| Cloudflare | Marketing-site Workers/D1/KV, media storage in R2, network/security services; website request information, CMS content and uploaded assets as applicable | Present in the code; D1 APAC reported by the owner and Worker target Singapore; individual buckets, backups and all other products are not thereby restricted to APAC |
| Backend host and MongoDB operator | Account/workspace records, forms, responses, billing references and integration configuration | MongoDB and an Express backend are confirmed; hosting company, service model and regions require production confirmation |
| Transactional email provider | Recipient addresses and message content, including configured notifications and follow-ups | SMTP delivery is implemented; the production provider and processing countries require confirmation |
An open-source database or client library name does not establish which legal entity hosts the data. No other host, monitoring vendor or customer-support processor is represented here as verified merely because it is common in the industry.
3. Optional AI processing
The AI implementation supports Anthropic and OpenAI, with Anthropic as its code default. This is not proof of the live environment's selection. Requests can include prompts, form context, conversation history, images and text extracted from supplied documents. Identify the actual enabled provider, contracting entity, countries, retention/training controls and transfer safeguards before making AI available for customer personal data.
4. Payments and sign-in providers
Stripe handles supported conventional subscription payments. Coinfat handles crypto invoices and payment confirmation. The data involved includes purchase/account references and payment details handled by the provider; cryptocurrency networks can contain publicly visible transaction information. These providers may act independently for payment compliance and fraud prevention, so they are not described as processors for every activity.
Customer forms may use separately connected payment services. The form-payment implementation also supports PayPal and Razorpay; availability depends on customer and deployment configuration. Those payments are distinct from an Onlyform subscription, and the form owner must identify the provider and relevant notices to its respondents.
Google and Apple process sign-in information if you choose their authentication options. Their separate identity-service terms and notices also apply. The available options depend on deployment configuration.
5. Customer-selected destinations
Customers may connect services such as Google Sheets, Microsoft services, Slack, Notion, Mailchimp, Zapier and webhooks, or configure Google Analytics, Google Tag Manager and Meta Pixel. The customer selects the recipient and must assess its role, notice, contract, consent and international-transfer requirements. Enabling a destination does not make all of that provider's independent activity an Onlyform sub-processing activity.
6. Changes
For processing under a completed DPA, sub-processor authorisation, advance notice and objections follow that agreement. This site does not currently provide a verified automatic subscription to sub-processor-change alerts. Obtain the complete production register and agreed notification channel before relying on it for procurement or a restricted international transfer.