What this list is. This list is part of each MicroForensics Engagement Letter that names this version by its date, as if set out in it. Where this list and that signed document disagree, the signed document prevails. Floburn keeps every version of this list at this address for as long as an Agreement that names it runs, and gives the Client a PDF of any version on request. A later version binds the Client only as the Agreement provides: by the written notice the Agreement requires before Floburn adds or replaces a Subprocessor, with the Client's right to object as the Agreement states, or by a written amendment signed by both Parties; Floburn publishes each change as a new dated version and never edits a version in place. In this list "the Agreement" means that Engagement Letter with its Schedules and every Statement of Work, Operated-Service Order and Change Order signed under it; "the Client" and "Floburn" are its Parties; a capitalized term has the meaning the Agreement gives it; and the classes are those the Floburn Data Protection Terms list.
Every provider that touches the Client's Personal Information, each entry checked and dated by Floburn before this version issued. Only the providers this list names touch the Client's Personal Information, each for the function stated.
| Provider | Function | Classes touched | Region of storage and compute | Terms | Retention where it holds content | Last checked |
|---|---|---|---|---|---|---|
| Hostinger International Limited | Server hosting for the Client's instance | C1–C6 | United States | Hostinger Terms of Service and Data Processing Addendum | For the term of the instance | October 15, 2026 |
| Amazon Web Services, Inc. | Encrypted backup storage | C1–C6 (encrypted) | United States, Oregon (us-west-2) | AWS Customer Agreement and AWS Data Processing Addendum | Daily copies, each deleted after 30 days | October 15, 2026 |
| Google LLC | Email, identity and the support inbox | C1, C4 (support correspondence only) | United States | Google Workspace Terms of Service and Cloud Data Processing Addendum | Until deleted; Google erases deleted data within 180 days | October 21, 2026 |
| Twilio Inc. | Text-message attestation delivery and Worker replies | C1 (name, phone), message text | United States, US1 | Twilio Terms of Service and Data Protection Addendum | Message records 30 days; backups up to 30 more | October 21, 2026 |
| SmartVault Corporation | Secure upload channel: the Client sends records for the records diagnostic, and Floburn returns deliverables | C1–C6 as the records the Client sends carry them; none of the data the Data Protection Terms list as not held | United States, written confirmation from SmartVault pending | SmartVault Terms of Service; SmartVault's data processing terms (written confirmation pending) | Until Floburn deletes it under clause 7 of the Agreement; a deleted file leaves SmartVault's recycle bin at once when Floburn empties it, and its backups within the period SmartVault confirms in writing (confirmation pending) | October 15, 2026; written confirmation pending |
| AC PM, LLC (Postmark) | Email attestation delivery and Worker replies | C1 (name, email), message text | United States, Virginia (us-east-1) and Oregon (us-west-2) | Postmark Terms of Service and Data Processing Addendum | Message content 45 days | October 17, 2026 |
| Anthropic, PBC | AI inference: message drafting; name matching, the two tasks the Data Protection Terms describe | C1 (names, for name matching only); message text | United States (US-only processing) | Paid business-tier terms; no training on content | Inputs and outputs deleted within 30 days; flagged content kept up to 2 years | October 21, 2026 |
Three further providers touch the Client's Personal Information only if Floburn uses them for the Client. The Agreement states, for each, whether it is in use when the Agreement is signed and, where it is, names it. One not in use then is added only after the written notice the Agreement requires before Floburn adds or replaces a Subprocessor, with the Client's right to object.
- AI provider, fallback only. AI inference, fallback only; it touches the data classes the primary AI provider's row lists. Its region and retention are those the Agreement states for the fallback provider in use. Terms: paid business-tier terms; no training on content.
- Floburn's California labor and employment outside counsel. Review of Floburn's deliverables, reading in Floburn's portal only; it touches C1 pseudonymized (per-client identifiers), and C2 and C3 as they appear in the deliverable reviewed, and the Client's name, address and telephone number. Region: United States. Terms: engagement letter with confidentiality and conflicts terms. Retention: holds none.
- A translation professional, only where a language beyond English is in scope and a review sample carries Personal Information. Review of Worker-facing text in each language in scope; it touches content text, and C1 only where a sample carries it. Region: United States. Terms: written agreement with confidentiality terms. Retention: none.
Code hosting, internal notification and scheduling tools hold no client operated data by design and are not Subprocessors.