Subprocessors

Hetzner, hosting. The whole application, the Postgres database and the web server run on a single Hetzner server, so Hetzner holds the disks that every piece of personal data 1Stop processes sits on.

Amazon Web Services, object storage. The storage adapter signs its own requests and sends them to whichever S3 endpoint it is configured with; the production deployment points it at Amazon S3 at https://s3.us-west-2.amazonaws.com, in the bucket 1stop-prod-uploads. What it receives is every uploaded file: before and after photographs of unit interiors, uploaded compliance documents such as certificates of insurance and W-9s, vendor logos, and generated PDF documents. This path is only active when the four STORAGE_S3_* environment variables are set. When they are not set, files are written to local disk on the Hetzner server instead and nothing reaches Amazon. The us-west-2 region is in the United States, so this is the point at which uploaded files leave Hetzner infrastructure.

Source: src/lib/storage/s3.ts and src/lib/storage/index.ts.

Amazon Web Services, email delivery. Outbound email is sent through Amazon SES in the us-west-2 region, from noreply@1stopservicepro.com. That includes the one-time passcode a provider or crew member signs in with. What it receives is the recipient's email address and the contents of the message. This path is only live when SES_REGION, SES_FROM_ADDRESS, SES_ACCESS_KEY_ID and SES_SECRET_ACCESS_KEY are all set. When they are not set, the message is written to the server log instead and no data leaves the server.

Source: src/lib/env.ts, where the SES configuration is declared.

Cloudflare, bot protection. The sign-in pages, the crew passcode request, the forgot and reset password forms, and the service request and vendor application forms load Cloudflare Turnstile from https://challenges.cloudflare.com. Turnstile checks that a person, and not a script, is filling in the form, and it usually does so without showing the visitor anything. For that check the browser sends Cloudflare information about itself, and Cloudflare sees the visitor's IP address because the browser connects to Cloudflare's servers. When the form is submitted, the application sends Cloudflare the one-time token the check produced and the visitor's IP address, and Cloudflare answers whether the check passed. Nothing typed into the form goes to Cloudflare, and pages without one of these forms do not load Turnstile. This path is only live when TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are both set. When they are not set, no page loads Turnstile and nothing reaches Cloudflare.

Source: src/components/bot/BotCheck.tsx and src/lib/bot/turnstile.ts.

Stripe, payments and payouts. When HQ sends a Client an invoice, the application gives Stripe the Client organization's name and billing email, and each invoice line with its amount and description, which can carry a work order reference. Stripe emails the invoice, and the Client pays on Stripe's hosted invoice page, so card and bank details go to Stripe and never pass through 1Stop's server. When a vendor sets up payouts, the application opens a Stripe Express account with the vendor's business name and email, and the vendor gives Stripe their bank and identity details on Stripe's own onboarding pages. Paying a vendor sends Stripe the amount and the payout reference, and Stripe reports what happened back through a signed webhook. Stripe is in the United States. This path is only live when STRIPE_SECRET_KEY is set. When it is not set, nothing reaches Stripe.

Source: src/lib/payments/invoices.ts, src/lib/payments/payouts.ts and src/app/api/stripe/webhook/route.ts.

Anthropic, AI drafting. Two features send text to Anthropic's Claude models, and only when someone uses them. On the new request form, a property manager can describe a job in one sentence and have the form filled in. That sentence goes to Anthropic, with the names, addresses and unit labels of the manager's saved properties, so the model can tell which one is meant. In HQ's mail client, a staff member can ask for a draft reply to an email. The text of that conversation goes to Anthropic, with the names and email addresses in it. The draft comes back to the staff member, who edits it and sends it, and the model never sends anything itself. Anthropic is in the United States. This path is only live when ANTHROPIC_API_KEY is set. When it is not set, nothing reaches Anthropic.

Source: src/lib/ai/intake/claude.ts and src/lib/ai/mail-draft/.

A map tile provider. A MAP_TILE_URL variable exists in .env.example, but it is never read anywhere in the code, and no mapping library is installed. No tile provider receives anything, and no map request carries a property address or a coordinate to a third party today.

Postgres. The database runs in a container on the same Hetzner server that runs the application. It is not a managed third-party database service, and no data leaves the server to reach it.

Google Fonts. Typefaces are loaded through Next.js next/font/google, which downloads the font files at build time and serves them from 1Stop's own domain. A visitor's browser makes no request to Google, and Google receives no visitor IP address.

GlitchTip, error tracking. When error tracking is switched on and the application or a visitor's browser hits an error, a report of it goes to a GlitchTip instance running in a container on the same Hetzner server, with its data in the same Postgres. GlitchTip is open-source software that 1Stop runs itself rather than a hosted service, so the reports stay on the server. A browser sends its reports to 1Stop's own domain, which passes them on. Before a report is stored, the application removes cookies, request bodies, passwords, tokens, passcodes, email addresses and phone numbers from it. Nothing records a visitor's session.

Source: src/lib/observability/scrub.ts and the glitchtip service in docker/compose.prod.yml.