Who else touches the data.
The real list, taken from what the application calls. A vendor that is not here is not processing client data for us.
| Vendor | What it does | What it can see |
|---|---|---|
| Vercel | What it doesHosting, the CDN, TLS, Web Analytics and Speed Insights. Vercel Blob is the file store for anything uploaded to a portal. | What it can seeThe request itself — IP address and user agent, as part of serving a page — and aggregate page views. Uploaded files and their bytes, stored private and read through the application. |
| Neon | What it doesManaged Postgres: the database behind briefs, portals, documents and payment records. | What it can seeEvery row described on the security page — contact details, brief answers, messages and notes, portal roles, document events, payment amounts. Not card numbers. |
| Resend | What it doesTransactional email delivery only: brief confirmations, sign-in codes, portal notices, team invitations. Open and click tracking are off. | What it can seeThe recipient's address and the contents of the message. Nothing is sent to anybody without a basis for it. |
| Stripe | What it doesCard payments. Deposits and retainers for builds run through the client's own Stripe account; plan purchases made on the plan page run through Nimos Websites' Stripe account. | What it can seePayment amount, status, and the identifiers Stripe returns. Card details are entered on Stripe's page and never reach this site or its database. |
| Meta | What it doesAdvertising attribution, only when advertising is running: Meta Pixel on pages and the Conversions API for Lead and Purchase events. | What it can seeHashed contact details, IP address, user agent, and the event (page view, lead, purchase). No card numbers, because they never reach us. Not loaded when advertising is not running. |
| Documenso | What it doesSignature envelopes for scopes and contracts. The signing page is the provider's own. | What it can seeThe signer's name and email address, the document being signed, and the signing events — issued, viewed, signed, declined. |
| GitHub | What it doesSource control and the CI that tests, type-checks and builds every change before release. | What it can seeThe build's repository: code and whatever content is committed to it. No customer records. |
| Sentry | What it doesError reporting, where a DSN is configured for the build. | What it can seeRoute, method, status, stack trace and release. Scrubbed before it is sent: token segments and query strings are removed from URLs, request bodies are dropped, cookie and authorization headers never leave, and anything shaped like a key or an email address is replaced. |
| Vercel AI Gateway | What it doesThe concierge, where it is switched on for a build: a question is answered by a model routed through the gateway. It drafts; a person presses send. | What it can seeThe text of the question asked of the concierge, and the answer. Routed through Vercel's gateway to a model provider. |
| Telegram | What it doesThe studio's own alert channel. When a contact form arrives, a plain-text message goes to the studio's private chat so it is seen the same hour rather than the next time a dashboard is opened. | What it can seeThe sender's name, email address, subject and message. There is no recipient parameter — the chat belongs to the studio, and this channel cannot be pointed at anybody else. |
Not on this list
Shopify
Commerce runs in the client's own Shopify account, under the client's own terms with Shopify. Where a build sells, the store, the catalogue and the customer records are theirs; we are given access to work on it, and it is not a place we put client data of our own.
Google Analytics 4 and Search Console
A client option, in the client's own account. GA4 is not loaded on this site — the analytics here are Vercel's, aggregate. Meta Pixel may be loaded for ad attribution when advertising is running; no other advertising pixel is loaded anywhere in the build.
Cloudflare
DNS, read only. The studio holds a token that can list zones and records and change nothing, used when a domain is captured for a handover. No personal data passes through it, and this domain resolves through Vercel DNS.
How this list changes
A vendor is added to this page before it handles client data, not after. A client on a care plan is told when a row is added, and a client who objects in writing gets an alternative or an exit from the affected part of the service.
Nothing here is inferred from a logo on a homepage. Each row is a call the application makes, in the file named on the security page.
Last reviewed 2 November 2026, against this repository.