Service Providers & Subprocessors
Company draft for attorney review. Version: launch-draft-1. Effective date: September 11, 2026. Operator: [LEGAL OPERATOR NAME], operating under the Pineform Labs brand. Questions and provider-change inquiries: [email protected].
Scope and verification status
This inventory identifies providers evidenced by the current application and staging configuration. It is not a representation that every provider has the same contractual role. Google also supplies the independently connected account service. Exact contracting entities, processor/controller roles, agreements, deployment settings, and international-transfer arrangements are to be confirmed before public launch. No certification, data-residency guarantee, or contractual notice period is claimed.
OpenAI
Purpose: AI response generation through the server-side OpenAI API. Broad data categories: prompts, relevant conversation history, bounded retrieved evidence, pseudonymous safety identifiers, generated responses, and usage metadata. The code requests disabled response storage, which does not establish zero provider retention. Processing location and transfer information: To be confirmed before public launch.
Purpose: Google identity verification and separately authorized read-only Gmail, Calendar, and Drive access, including OAuth token exchange, refresh, and revocation. Broad data categories: account identity, authorization credentials, Workspace read queries, and authorized message/event/document metadata and content. Google's role as the user's account provider is distinct from any processing performed for Soren; the applicable roles and agreements require review. Processing location and transfer information: To be confirmed before public launch.
Render
Purpose: configured private staging application hosting and persistent disk storage. Broad data categories: network/request information processed by the host, application and security logs, identity/session records, tenant conversations and operational records, and encrypted Workspace credentials on the service disk. Processing location, snapshot/backup handling, and transfer information: To be confirmed before public launch. The repository configuration does not establish the live service's region or all account-level settings.
Changes
We will maintain this inventory as providers change and provide notices required by applicable agreements or law. No billing processor, email delivery vendor, hosted voice provider, analytics vendor, or other subprocessor is asserted merely because a future feature might need one. Open-source libraries running within Soren are not automatically separate hosted data recipients.
Questions about this list may be sent to [email protected]. Postal contact: Pineform Labs / [LEGAL OPERATOR NAME], 1550 Wilson Blvd, Ste 700 PMB264, Arlington, VA 22209.