DealerDOH Service Providers
Runtime providers — v1.1 stack
| Provider | Role | Data it processes | Region | Status |
|---|---|---|---|---|
| Vercel | Frontend hosting/CDN | Serves the app to browsers; platform edge/request logs (connection metadata incl. IP) | US/global edge | Active — production and development |
| Render | API hosting | All application traffic; service logs (request lines incl. client IP, structured app logs); production service disk (database file, uploaded report files, generated reports) | Oregon, US | Active — production and development |
| Supabase | Sign-in (Auth) + PostgreSQL database | Staff account identities (email, password credentials, session state, display name), authorization/membership rows, all operational business data; provider auth/audit logs | us-west-2 (Oregon, US) | Active — production database since the v1.1 data cutover and staff sign-in since auth activation (both August 31, 2026); processes real operational and staff-account data |
| Sentry | Error monitoring | Error/exception events — configured to exclude user identity, request bodies, cookies; masked URLs; request references. Retention ~30 days on the current plan | US (SaaS) | Active — production error monitoring wired and runtime-verified August 31, 2026 |
| PostHog | Product analytics | Named product events under an internal account identifier (never email/name); role/store identifiers; ingest-side connection metadata. Event retention ~1 year on the current plan | US cloud | Active — production product analytics wired and runtime-verified August 31, 2026 |
| Northwest Registered Agent | Domain registrar, DNS, and email service for dealerdoh.com | Emails sent to the support/privacy address (which may include staff names/addresses and whatever senders include); DNS records | US | Active at publication — hosts support@dealerdoh.com (privacy@ forwards to it) |
Today's actual production processors: all providers in the table above. The v1.1 production cutover and activation completed on August 31, 2026 through the approved release process; Supabase, Sentry, and PostHog were flipped planned → active on this page only after each was wired in production and runtime-verified, as this page previously committed. (Their separate development projects continue to process synthetic development data only.)
Development infrastructure (not a subprocessor of dealership data)
GitHub hosts the private source-code repository and CI. It processes source code and synthetic test fixtures only — no real dealership operational data, no customer data, and no secrets are in the repository (full-history audit clean; real exports and databases are exclusion-listed and verified absent). CI runs against synthetic data and disposable containers.
Planned — not currently active
An inbound-email provider for scheduled vendor-report delivery is deferred and not active — the automated vendor-report acquisition it would serve is deferred pending pilot/contract authorization and required vendor evidence. No such provider processes anything today, and none activates in v1.1. If adopted later, this page and the Privacy Policy will be amended first.
Changes
Provider additions or changes that affect dealership data will be reflected here before they take effect, with this page's date updated.