confidentialoperations/vendors/README.md
Vendors
- Owner
- Bence
- Updated
- 20 August 2026
- Review
- quarterly
Everything erudeon pays for or depends on.
This is reference: looked up, never read through.
Each vendor records the account owner, what it costs, when it renews, what data it holds,
and under which agreement it holds it.
The data column is not optional: it is the working half of the GDPR processing register
in legal/processing-register.md, and a processor that holds member data without a
recorded agreement is a compliance gap rather than an admin gap.
Review one with /vendor-review.
The register
Cost and renewal columns are deliberately blank rather than guessed. Fill them from the actual billing before relying on this page.
| Vendor | What it does | Holds member data? | Cost | Renews |
|---|---|---|---|---|
| Stripe | Payment processing, SCA, iDEAL, tax, subscriptions | Yes — name, email, payment metadata | ? | ? |
| Zoho Books | Accounting, VAT invoices, credit notes | Yes — billing name and address | ? | ? |
| Jortt MKB | Accounting, incoming — see decision 0001 |
Yes, once live | ? | ? |
| Resend | Transactional email, both brands on one account | Yes — email addresses | ? | ? |
| Zoom | Live accelerator sessions, pool of owned accounts | Yes — name and email of attendees | ? | ? |
| PostHog | Product analytics, Flow only, EU Cloud | Pseudonymous only — never an email or a name | ? | ? |
| Apple | App Store, native iOS distribution | Yes — via the store relationship | ? | ? |
| Google Play | Android store presence | Yes — via the store relationship | ? | ? |
| Expo | Push notification transport, native builds | Device push tokens | ? | ? |
| Google OAuth | Sign in with Google | Yes — email, name | ? | ? |
| Google Maps | Place and location lookup on events | No | ? | ? |
| Spotify | Music metadata on Flow events | No | ? | ? |
| Hostinger | The two VPS: production and staging | Yes — the database lives here | ? | ? |
| Cloudflare | DNS and proxy | Traffic metadata | ? | ? |
| GitHub | Code, CI, and this repository | No member data, by rule | ? | ? |
| GlitchTip | Error tracking | Incidental — whatever an error carries | ? | ? |
| Framer | Public marketing site | Lead form submissions | ? | ? |
What still needs doing
- Fill in cost and renewal date for every row from the actual billing.
- Record which rows have a signed data processing agreement, and where it is filed.
- Cross-check this list against
legal/processing-register.mdso no processor appears in one and not the other.