| Service | Observed/proposed purpose | Verification required |
|---|---|---|
| Lovable / backend hosting and Supabase technology | Application hosting, auth, database and functions | Contracting entity, actual operator/region, downstream providers and DPA |
| AI gateway and OpenAI / Google models | Model-backed scans and drafts | Gateway chain, selected models, recipient entities, retention/training terms and locations |
| Anthropic | Direct AI requests where configured | Live use, DPA, retention/settings and region |
| Perplexity | Direct search/AI requests where configured | Live use, DPA, retention and location |
| Stripe | Payments and billing | Actual entity and controller/processor roles; customer data fields |
| Resend | Transactional email where enabled | Live use, entity, DPA and location |
| Sign-in, Search Console and Analytics connections | Enabled APIs, scopes, recipients and Google-data restrictions | |
| DataForSEO | Customer-authorized research | BYOK relationship, data sent and applicable role |
| WordPress host / Shopify | Customer-directed publication | Customer's destination, credentials and respective roles |
| Cloudflare | DNS and any enabled proxy/security services | Whether traffic is proxied; enabled products and data access |
| Sentry / PostHog | Conditional server-side monitoring code | Whether configured/called, payloads, retention and privacy basis |
AskEngineAI