Service providers
Every data flow needs an owner
A named production register will replace this category register before external processors are activated.
Production activation rule
No provider is enabled until its legal name, entity, processing location, purpose, data categories, retention, contract, transfer, deletion and incident-response path are recorded and approved.
| Category | Purpose | Data boundary |
|---|---|---|
| Regional cloud | Application, database, encrypted files, queues and backups | Saudi/approved regional location |
| Email and push | Requested sign-in links, reminders and security notices | Minimum destination and delivery metadata |
| Payments | Checkout, subscription state, retries and receipts | No child health record |
| Monitoring and security | Redacted reliability telemetry, alerts and vulnerability scanning | No request bodies, cookies or health content |
| Support | User-submitted inquiry and case evidence | Case-scoped, time-limited access |
Changes
Material provider changes receive a transfer and privacy review and are published here before processing begins. Users are notified when the impact requires it.