TRANSPARENCY REGISTER

Connected Services & Subprocessor Register

This register lists the providers Oprun can connect to. A provider is only active once it is connected and authorised for your business.

1. Core principle

Oprun should keep its own product data model, permissions, workflow state and audit evidence under the Oprun operator account. Customers connect external services through approved authorisation flows; they should not be asked to paste developer secrets into normal product forms.

2. Provider categories

Application hosting / database / object storage: production provider to be selected and documented. Structured records should use an encrypted transactional database; recordings, files and media should use encrypted object storage with versioning/retention controls.

Email: Resend support exists in this build when explicitly configured by the operator.

Telephony / SMS: Telnyx support exists in this build when explicitly configured by the operator.

Social platforms: Meta/Facebook/Instagram, WhatsApp, TikTok, YouTube/Google, Snapchat and X connectors are represented as self-service connection foundations. Each becomes active only after the operator configures the official application credentials and the customer completes provider authorisation.

AI models: provider abstraction is the target architecture. No provider should receive customer data merely because an AI feature is visible; production model use must be documented with purpose, region/transfer considerations, retention settings and permissions.

3. Customer controls

Connections should be revocable, least-privilege, scoped to the requested capabilities and visible in the Connections Hub. Oprun should record who connected or disconnected a service and when.

4. Data location and transfers

The operator publishes the production hosting region(s), relevant subprocessors, cross-border processing arrangements, data retention settings and material changes to this register. Sector or customer contracts may require additional location restrictions.

5. Drive and OneDrive

Google Drive, Microsoft OneDrive and similar services can be optional document destinations or customer integrations. They are not intended to be the primary Oprun database, security ledger or system of record.

6. Change governance

Material provider changes should pass security/privacy review before activation. High-risk credentials belong in a dedicated server-side secrets service with access logging and rotation, not source code, browser storage or customer-facing database fields.