Itemra — Subprocessor List
Controller / Processor: BRANDSDAL AS ("Itemra"), org. no. 924 873 078, Tyinvegen 1035, 2918 Ulnes, Norway (postal address: Postboks 33, 2959 Røn, Norway). Contact for data-protection enquiries: contact@itemra.io (named privacy contact; no formal DPO is designated). Last updated: [EFFECTIVE_DATE] · Version: [VERSION]
About this list
Itemra is a multi-tenant warehouse/inventory SaaS. For the personal data contained in customer inventory and operational records, including the content of customer-data-derived operational alerts and digests, Itemra acts as a processor on behalf of each customer (the controller). For account, identity, billing, support and telemetry data, personal notification preferences, and Itemra-owned account/service communications, Itemra acts as a controller. A provider can therefore serve both role scopes, as Resend does for email delivery. The third parties below process personal data on Itemra's behalf to deliver the service. This list is kept in sync with DPA Annex 3 and the Recipients section of the Privacy Policy.
Configuration note (must be confirmed before publication): Several integrations are feature-flagged off or have empty connection strings in the repository defaults (e.g.
WorkOs:Enabled=false,Stripe:Enabled=false, empty Storage/WorkOS connection strings). This list describes the intended production configuration, which the founder must confirm. Remove any subprocessor that is genuinely not enabled in production.
First-party hosting note (must be confirmed before publication): The Itemra application and primary SQL Server database are intended to run on Itemra-operated, self-hosted infrastructure in Norway / the EEA ([VERIFY_SELF_HOSTED_APP_AND_SQL_LOCATION]). Because Itemra operates that infrastructure directly, it is not listed as a subprocessor. Azure Blob Storage remains an external subprocessor for uploaded file content.
Intended production subprocessors (verify before activation)
| # | Subprocessor (legal name) | Purpose / role | Data categories accessed | Processing location | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | WorkOS, Inc. | Authentication & identity (AuthKit SSO, hosted sign-in/sign-up), organization + user-membership management, user invitations, federated logout. Authoritative identity store; Itemra keeps a local read-model mirror. | End-user email, first/last name, WorkOS user id; organization name, primary email domain, organization id; role slugs; invitation emails. Access token, refresh token and session id (sid) are exchanged. No customer inventory data is sent. | United States (api.workos.com). Data-residency tier/region [PLACEHOLDER — confirm WorkOS data residency / EU region with vendor]. | EU–US DPF where WorkOS is self-certified, else EU SCCs (controller-to-processor) + supplementary measures. [VERIFY_WORKOS_DPF_STATUS on dataprivacyframework.gov] |
| 2 | Microsoft Azure — Azure Blob Storage (Microsoft Ireland Operations Ltd / Microsoft Corp.) | Object storage for customer-uploaded attachments (item/container photos, documents) and bug-report screenshots/files. Issues short-lived single-blob SAS URLs; private container (no public access). | Customer inventory attachment file bytes + content-type + blob path (processor scope). Bug-report screenshot/attachment file bytes (may contain personal data depending on what the user captures). | Microsoft Azure Blob, region [VERIFY_AZURE_BLOB_REGION — confirm storage-account region]. Private containers, Managed Identity / SAS (see project memory project_blob_storage.md). | EEA region pinning + Microsoft Online Services DPA & SCCs for any incidental US support access. |
| 3 | Stripe, Inc. (and Stripe Payments Europe, Ltd. where applicable) | Billing & subscription payments. Creates Checkout subscription sessions and Billing Portal sessions; receives subscription lifecycle webhooks to sync plan state. | Billing/account data (controller scope): WorkOS organization id (as ClientReferenceId + metadata), customer email, plan key/price id. Receives back Stripe customer id + subscription status/price. No inventory data sent. Payment-card data is collected by Stripe directly in its hosted Checkout, not via Itemra's backend. | United States / Ireland / global. Account region [PLACEHOLDER — confirm Stripe account region / EU data handling]. | Stripe is EU–US DPF self-certified (stripe.com/legal/data-privacy-framework) + EU SCCs via Stripe's DPA. [VERIFY current DPF listing] |
| 4 | GitHub, Inc. (Microsoft) | In-app bug/feedback report capture — creates a GitHub Issue (owner cwbrandsdal, repo Itemra) for each submitted bug/feature/question report. New reports retain a durable tenant-to-issue correlation so tenant erasure can delete the issue through GitHub. | Reporter name, reporter email, WorkOS user id, organization id; page URL, free-text description, arbitrary metadata JSON; clickable SAS download links (7-day TTL) to uploaded screenshots/attachments (the files live in Azure Blob). All embedded in the issue body. | United States / global (api.github.com). Region [PLACEHOLDER]. | EU–US DPF where GitHub/Microsoft is certified, else EU SCCs + supplementary measures. [VERIFY listing] |
| 5 | Frankfurter (FX rates API) [VERIFY_FRANKFURTER_HOST_AND_OPERATOR] | Foreign-exchange rates for purchasing/valuation features; results cached locally (~18h TTL) with static fallback. | No personal or customer data. Only ISO currency codes (e.g. NOK, EUR, USD, GBP, SEK, DKK) in the query string. Listed for transparency only; arguably not a personal-data subprocessor. | api.frankfurter.dev (public, open-source FX API). Region [PLACEHOLDER — typically EU-hosted]. | Not a personal-data transfer (no personal data is transmitted). |
| 6 | Resend — Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114; privacy@resend.com (contracting entity verified 2026-08-19) | Email delivery. Controller scope for Itemra-owned account, trial, billing and service-administration messages; further-processor scope for customer-instructed operational alerts and real-time/hourly/daily/weekly digests. | Recipient email/name; subject and localised HTML/text body; organisation name/branding; notification kind/severity; operational details rendered into the message (for example item/tool names, stock quantity, count/task/purchase-order/transfer/reservation identifiers or status, assignee, and due/expiry timing); authenticated entity/manage-preferences/unsubscribe links or tokens; pseudonymous delivery correlation id. Current notification email does not include attachment file bytes. | United States (primary processing); API endpoint https://api.resend.com (verified 2026-08-19). | EU-U.S. Data Privacy Framework certification (including the UK Extension) plus EU SCCs (Module 2) incorporated in Resend's DPA (verified 2026-08-19). Domain authentication and a send-only API key are operational requirements, not proof of a transfer mechanism. |
Optional / deployment-dependent subprocessor
| # | Destination | Purpose / role | Data categories | Processing location | Notes |
|---|---|---|---|---|---|
| 7 | OpenTelemetry OTLP collector / observability backend (optional) | Telemetry export — distributed traces + metrics via OTLP gRPC exporter. Exporter is registered only when Otel:Endpoint is configured (no endpoint → no export). | Operational telemetry. Traces include HTTP request data, recorded exceptions, and outbound-call target URLs/hosts. Separately, request-scoped Serilog logs carry UserId and OrganizationId. | Browser error telemetry: Sentry (Functional Software, Inc.) with EU data residency (EU-hosted .de.sentry.io ingestion and storage), receiving minimised error events only — error category, release, environment and trace ID; no message content, stack traces, or user data. Backend OTLP export remains unconfigured; application logs remain in size-bounded on-host container logs (Serilog console sink). | If a hosted telemetry backend is enabled in production, add it as a named subprocessor with its region and transfer mechanism. |
Privacy points flagged for legal review
- GitHub issues contain reporter PII. Bug reports embed reporter name, email, user id, organization id and SAS links to uploaded files. The
cwbrandsdal/Itemrarepo was verified private on 2026-08-15; assess whether routing customer PII into GitHub Issues is acceptable or needs a notice/redaction process. New issues are correlated for tenant export/erasure; historical issues created before that migration require manual reconciliation. - Bug-report retention (approved 2026-08-19, IMP-059). Bug-report file SAS download links are valid for 7 days; anyone holding the issue link can fetch the file until expiry. Uploaded bug-report files are retained for 90 days; the production Blob lifecycle policy enforcing that window is configured at commercial activation. Tenant erasure deletes correlated issues and recorded blobs earlier.
- Telemetry carries identifiers. Request logs and traces include UserId/OrganizationId; document the telemetry sink as a subprocessor once its destination is confirmed.
- Resend spans both role scopes. Its operational alert/digest bodies may contain Customer Personal Data. The contracting entity (Plus Five Five, Inc.), processing region and endpoint (United States;
https://api.resend.com), and transfer basis (EU-U.S. DPF including the UK Extension, plus EU SCCs Module 2 in Resend's DPA) were verified 2026-08-19; ensure the executed provider terms cover both controller-to-processor and processor-to-subprocessor use as applicable. - Resend retention, suppressions and DSAR. Resend retains sent email content for 30 days and delivery/activity data for 30 days; it maintains an automatic suppression list, and customer data is deleted within 90 days of account termination. Access, restriction and erasure requests are reconciled with bounce/block/spam-report/unsubscribe records without re-enabling unwanted mail, and are escalated to privacy@resend.com under Resend's DPA where provider-side deletion is required (process adopted 2026-08-19; first-exercise evidence to be recorded on the next DSAR or before commercial launch).
- External providers must be covered. DSAR/erasure must cover WorkOS, Stripe, Resend delivery activity/suppressions, GitHub and Azure Blob, subject to each provider's approved region, role and retention, in addition to the self-hosted SQL Server database.
- Tenant archives exclude secrets. Refresh-token ciphertext, WorkOS session ids, credential/signing-secret ciphertext and hashes, and row-version bytes are deliberately omitted. Tenant erasure deletes active organization sessions while retaining immutable consent evidence with its organization context de-linked.
How customers are notified of changes
Consistent with the sub-processor clause in the Data Processing Agreement (DPA Art. 28(2) & (4)):
- Advance notice. Itemra will give customers at least 30 days' prior written notice before adding or replacing a subprocessor that processes personal data, except where a faster change is required for security or legal reasons (in which case notice is given as soon as reasonably practicable).
- How to subscribe to updates. Customers can subscribe to change notifications by contacting contact@itemra.io. This document is also versioned and dated; the current version is always available at https://itemra.io/subprocessors.
- Right to object. During the notice period a customer may object on reasonable data-protection grounds by contacting contact@itemra.io. The parties will work in good faith to resolve the objection; if it cannot be resolved, the customer may terminate the affected part of the service without penalty, in accordance with the DPA.
- Synchronisation. Any change here is mirrored in DPA Annex 3 and reflected in the Privacy Policy's recipients section.
Grounding (source file references):
- WorkOS:
src/backend/infrastructure/Itemra.Integrations.WorkOS/WorkOsService.cs,WorkOsOrganizationGateway.cs,WorkOsUserDirectoryGateway.cs,WorkOsAuthenticatedContext.cs,WorkOsOptions.cs;src/backend/host/Itemra.Api/appsettings.json(lines 52–59). - Self-hosted SQL Server:
src/backend/infrastructure/Itemra.Persistence/DependencyInjection.cs(line 114,UseSqlServerwithEnableRetryOnFailure,CommandTimeout(30));src/backend/host/Itemra.Api/appsettings.json(lines 2–4);src/backend/host/Itemra.Api/Program.cs(lines 106–110);src/backend/infrastructure/Itemra.Persistence/Audit/AuditLogger.cs. - Azure Blob:
src/backend/infrastructure/Itemra.Integrations.Storage/AzureBlobAttachmentStorage.cs,AzureBlobOptions.cs,DependencyInjection.cs;src/backend/host/Itemra.Api/Services/GitHubBugReportService.cs. - Stripe:
src/backend/infrastructure/Itemra.Integrations.Stripe/StripeBillingGateway.cs,StripeWebhookProcessor.cs,StripeOptions.cs;src/backend/host/Itemra.Api/Program.cs(line 63);appsettings.json(lines 60–72). - GitHub:
src/backend/host/Itemra.Api/Services/GitHubBugReportService.cs; the shared GitHub issue gateway/options undersrc/backend/infrastructure/Itemra.Infrastructure; and the durable correlation model/store undersrc/backend/core/Itemra.Domain/Diagnosticsandsrc/backend/infrastructure/Itemra.Persistence/Diagnostics. - Frankfurter:
src/backend/infrastructure/Itemra.Infrastructure/Purchasing/FrankfurterFxRateProvider.cs(line 90);src/backend/infrastructure/Itemra.Infrastructure/DependencyInjection.cs(lines 56–63);FxRateOptions.cs(line 15);appsettings.json(lines 14–34). - Resend:
src/backend/infrastructure/Itemra.Infrastructure/Notifications/PlatformEmail/ResendPlatformEmailSender.cs,ReportSubscriptionEmailSenders.cs,PlatformEmailOptions.cs, andPlatformEmailConfigurationHealthCheck.cs;src/backend/infrastructure/Itemra.Infrastructure/DependencyInjection.cs; internal API and Worker production appsettings. - OpenTelemetry:
src/backend/infrastructure/Itemra.Infrastructure/DependencyInjection.cs(lines 97–139);Observability/OtelOptions.cs;src/backend/host/Itemra.Api/Program.cs(lines 125–145). - No AI/LLM egress: all "AI" features are local
Heuristic*implementations (src/backend/infrastructure/Itemra.Infrastructure/DependencyInjection.cslines 84–91;HeuristicDatasheetEnricher.cs). No external datasheet/part-enrichment vendor.
Publication gate: This list remains a counsel-review draft. It must be synchronised with DPA Annex III and the Privacy Policy, translated and approved in matching Norwegian Bokmål and English versions, and have every provider placeholder resolved before publication, canonical version advancement, or user re-acceptance.