Current providers
OpenAI Sites hosts this private preview and supplies ChatGPT sign-in identity. Cloudflare D1 stores organisation and test-billing records. The Cloudflare DNS resolver receives the organisation-domain lookup used for verification.
Stripe handles test checkout and billing-portal flows where configured. The application sends the organisation identifier when it creates a test customer. Stripe can act as controller or processor depending on the activity.
Before launch, confirm each contracting entity, service role, agreement, data categories, locations and transfer safeguards. This provider inventory is not an approved contractual subprocessor schedule.
Browser storage
The reviewed setup application does not add its own analytics cookies or localStorage records. The hosted sign-in and Stripe pages are separate surfaces; their actual cookies and storage have not been inventoried. This is not a claim that the full service is cookie-free.
Before launch, record storage names, providers, purposes and lifetimes across sign-in, setup and checkout. Provide consent controls before optional tracking where required. Strictly necessary storage still needs a clear disclosure.
Locations and retention
No EU-only processing or fixed deletion period is verified. A D1 location hint is not a residency guarantee. A database jurisdiction setting does not, by itself, restrict every hosting or identity operation to that jurisdiction.
The operator must confirm retention and deletion for organisation records, receipts, provider logs and backups. Expiring a challenge, checkout intent or future recipe is not equivalent to deleting all associated personal data.
Official references
These sources inform the draft. They do not endorse Alethrai.