Nore beta policy
Service providers and subprocessors
Implementation draft of the external services expected to process data for the Nore Public Alpha.
This text is an implementation draft and requires human and legal review before public launch.
Policy status
Effective date: 2026-07-27. Last updated: 2026-07-30. Version: alpha-public-v1. English (United States) controls.
This is a technical inventory, not a lawyer-approved subprocessor notice. Provider legal entities, regions, transfer terms, agreements, security links, and retention must be verified before G1.
Service providers and subprocessors
| Provider and services | Purpose | Expected data | Review state |
|---|---|---|---|
| CloudflareWorkers, R2, Stream, Hyperdrive, Turnstile | Application delivery, network and abuse protection, object storage, video processing, database transport, and human-verification challenges. | Requests and temporary network metadata, media objects, encoded video, database traffic, and challenge signals. | Technical use identified; legal and operational verification pending |
| NeonServerless Postgres | Managed relational storage for account, product, safety, and operational records. | Account, profile, content, communication, moderation, preference, audit, and operational database rows. | Technical use identified; legal and operational verification pending |
| ResendTransactional email | Email verification, password reset, account-deletion lifecycle, and other transactional notices. | Recipient email address, delivery metadata, and minimized transactional message content. | Technical use identified; legal and operational verification pending |
| SentryError reporting, Source maps | Diagnose application errors and reliability problems. | Minimized technical diagnostics. Secrets, authentication material, date of birth, and raw private content are prohibited. | Technical use identified; legal and operational verification pending |
| AblyRealtime messaging | Deliver realtime product events to authorized clients. | Scoped client identifiers, channel names, presence state, and minimized event payloads. | Technical use identified; legal and operational verification pending |
| LiveKitLive audio and video | Transport authorized live audio/video sessions and enforce participant access. | Scoped participant identity, room metadata, connection metadata, and live media transport. | Technical use identified; legal and operational verification pending |
| OpenAIModeration API | Classify public text and uploaded media before availability under the Alpha moderation policy. | Only text or media required for a moderation decision. Private DM text is excluded from proactive third-party review and is reviewed only after a user report through the restricted evidence path. | Technical use identified; legal and operational verification pending |
Better Auth is a software component running inside Nore infrastructure and storing its records in Nore-managed Postgres. It is listed in Privacy for transparency but is not classified here as a separate external data recipient.