Service Provider Inventory
A technical inventory of third parties documented in Praesidia's current production path and platform integrations.
Technical inventory last verified: 16 October 2026. This page reports the service-provider data path supported by the repository's deployment policy, runbooks, and runtime integrations. It is not a contractual subprocessor schedule and, beyond the region of each Amazon Web Services service production runs on and the OpenAI processing region for platform-configured calls, does not assert provider regions, transfer mechanisms, change-notice periods, or negotiated legal roles. Request reviewed contractual information from legal@praesidia.ai.
| Provider | Documented technical role | Data that may pass through the service |
|---|---|---|
| Amazon Web Services (AWS) | Production hosting since 7 October 2026: compute, data storage, queues, key management, transactional email (Amazon SES), and monitoring in the eu-central-1 region (Frankfurt, Germany), and delivery of the website and the app through Amazon CloudFront. Each service and its region is listed below | Account and platform data, including request and response content, audit-trail records and exports, queued work, email recipients and message content, and service logs |
| Cloudflare | Authoritative DNS for praesidia.ai. Since 7 October 2026 Cloudflare no longer proxies requests or terminates TLS for Praesidia's services. Cloudflare Web Analytics, when enabled, measures public website visits, referral sources and page performance through a browser beacon | DNS lookups of Praesidia hostnames. Website measurement separately sends page and referrer URLs, an ephemeral page-load identifier and performance metrics. Cloudflare receives the network address to process the request and says it discards it at the nearest data center; the beacon uses no cookies or browser storage. GPC and DNT disable measurement before the beacon loads |
| Render (former host) | Hosted Praesidia's production app, API, MCP server, model gateway, and website until 7 October 2026. Those services no longer serve Praesidia's domains and are kept only until they are deleted | Account and platform data those services handled before 7 October 2026, until the services are deleted |
| Stripe | Payment processing, invoicing, and subscription billing | Billing contact, transaction, and payment-method data |
| Sentry (when configured) | Application error monitoring and crash diagnostics | Technical error and request diagnostics, which may include limited account identifiers |
| Sigstore Rekor (when external anchoring is enabled) | Public transparency-log anchoring for audit-integrity proofs | A signed hash of each audit-trail batch and the public key that verifies it; never the audit records or their content. Log entries are public and permanent. |
| OpenAI (platform-configured connection) | Model inference when an organization uses the platform's configured default instead of its own provider connection, and guardrail content evaluation and moderation screening when configured. Platform-configured calls are processed on OpenAI's standard (US) API by default, or on OpenAI's EU data-residency API when the deployment is configured for it. An organization's own OpenAI connection uses that organization's OpenAI account instead | Prompt and response content for those model requests, and the content screened by those guardrail checks |
| Anthropic (when configured) | Guardrail content evaluation (LLM judge) | Prompt and response content sent for evaluation |
| Microsoft Azure AI Content Safety (when configured) | Guardrail content-moderation screening | The content screened |
Amazon Web Services: services and regions
| Service | What Praesidia uses it for | Region |
|---|---|---|
| Amazon ECS on AWS Fargate, with Elastic Load Balancing and AWS WAF | Runs the app, API, MCP server, model gateway, and background workers; terminates TLS for API, MCP, and gateway connections and filters their requests | eu-central-1 (Frankfurt, Germany) |
| Amazon RDS | The platform's relational database, with its automated backups | eu-central-1 (Frankfurt, Germany) |
| AWS Backup | Daily database recovery points, each copied to a disaster-recovery vault in a second EU region and kept there for 35 days | eu-central-1 (Frankfurt, Germany); disaster-recovery copies in eu-west-1 (Dublin, Ireland) |
| Amazon ElastiCache | In-memory cache for the platform services | eu-central-1 (Frankfurt, Germany) |
| Amazon SQS | Message queues for background work | eu-central-1 (Frankfurt, Germany) |
| Amazon S3 | Object storage for audit-evidence exports, access logs, and the website's published files; signed remediation evidence is replicated to a disaster-recovery bucket | eu-central-1 (Frankfurt, Germany); remediation-evidence replica in eu-west-1 (Dublin, Ireland) |
| AWS KMS and AWS Secrets Manager | Encryption keys and service credentials; data-bearing credentials are replicated, and the disaster-recovery vault has its own key | eu-central-1 (Frankfurt, Germany); credential replicas and the disaster-recovery vault key in eu-west-1 (Dublin, Ireland) |
| Amazon SES | Transactional delivery of account, security, and product email | eu-central-1 (Frankfurt, Germany) |
| Amazon CloudWatch | Service logs, metrics, and alarms | eu-central-1 (Frankfurt, Germany) |
| Amazon CloudFront, with AWS WAF | Delivers the website and the app: terminates TLS, filters requests, and caches the website's public pages before forwarding requests to eu-central-1, where its access logs are stored | Edge locations in North America, Europe and Israel |
Current hosting boundary
Since 7 October 2026, Amazon Web Services (AWS) hosts Praesidia's production app, API, MCP server and model gateway in the eu-central-1 region (Frankfurt, Germany), and the data those services store is held in that region, apart from the disaster-recovery copies listed above, which stay in a second EU region. Amazon CloudFront terminates TLS for the website and the app at edge locations in North America, Europe and Israel before forwarding requests to Frankfurt, so this inventory does not describe an EU-only data path; API, MCP and gateway connections terminate TLS in Frankfurt. Cloudflare provides authoritative DNS without proxying website delivery. When enabled, Cloudflare Web Analytics separately receives page and performance measurements from the browser.
Customer-configured model connections
An organization can configure its own provider connection. Configure an agent's model with your own keys for OpenAI, Anthropic, Azure OpenAI, Google Gemini, Mistral AI, Cohere, DeepSeek, Qwen, Moonshot, Ollama or an OpenAI-compatible endpoint. Model configuration is in every plan. Gateway routing is a separate path: custom OpenAI-compatible routes require the Advanced tier or Enterprise and deployment enablement. Check the supported route and authentication mode for your provider. Praesidia routes model requests only to the connection selected for that organization. The contractual role of a customer-selected provider depends on the applicable account and agreement and is therefore not assigned by this technical inventory.
Questions
For technical privacy questions, email privacy@praesidia.ai. For questions about the availability of a reviewed DPA or contractual provider schedule, email legal@praesidia.ai.