01
Required register fields
For every provider, the approved register will state provider legal entity, service, purpose, customer-data categories, data-subject categories, processing/storage locations, transfer mechanism, optional or customer-authorized status, and effective date.
02
Infrastructure and storage candidates
Production review must confirm the application hosting provider and Dokploy environment, Cloudflare services including R2 and DNS where enabled, and AWS or another S3-compatible backup provider. Bucket names and credentials must never be published.
03
Monitoring and communications candidates
Production review must confirm Sentry or another monitoring provider, SMTP and transactional-email providers, Google Workspace services, customer-support tooling, and external uptime monitoring that may receive identifiers, diagnostics, or message content.
04
Analytics and integration candidates
Production review must confirm Google Analytics and each enabled customer-authorized integration, including PayPal Point of Sale/Zettle. A customer-directed independent controller should be distinguished from a Batch Scale subprocessor.
05
Contract and security review
Before activation, Batch Scale must document the provider contract and DPA, confidentiality, security evidence, incident duties, deletion/return, audit rights, locations, subprocessors, and transfer safeguards. Least-privilege credentials and environment separation must be verified.
06
Change notice and objection
Material additions will be communicated in advance as required by the DPA. The final process must state notice period, subscription method, objection grounds, good-faith resolution, alternatives, and termination rights.
07
Current status and requests
The register remains a launch blocker until infrastructure, communications, monitoring, backup, analytics, and integration providers are verified. Requests may be sent to [email protected] with the subject “Subprocessor register.”