Draft 0.2 · issued 19 August 2026 · pre-launch

Service providers and subprocessors

No production customer-file processors are activated: this is a pre-launch transparency register, not a representation that every candidate provider is contracted or receiving data. PackDossier's commercial file-processing gate must remain closed until each active provider, location, role and transfer safeguard is verified and the operative DPA is available.

Blue Ridge Federal LLC, trading as PackDossier, publishes this page to distinguish providers used for public-site or test operations from providers authorised to process production Customer Materials. Questions may be sent to support@blue-ridge-federal.com.

1. How to read this register

Public-site or test only means the provider may support development, authentication, website delivery or sandbox testing, but is not approved by this page to receive production Customer Materials.
Disabled means the integration exists only as code or a planned capability and cannot send or receive production data.
Production will be used only after the provider entity, purpose, data categories, locations, contract and transfer position are verified and this register is updated.

2. Pre-launch provider inventory

Cloudflare infrastructure

Status: public-site or planned production infrastructure; not legally activated for paid customer-file processing by this draft.

Intended functions include network delivery, application hosting, private database storage and private object storage. Request metadata and IP addresses may be processed when a hosted site is accessed. The selected D1 database and R2 object-storage configuration uses Cloudflare's automatic placement, without an EU jurisdiction restriction. Cloudflare chooses a primary placement for each resource and may serve requests through its distributed network. This is not an EU-only residency commitment. Account records and Customer Materials may be processed only after the production bindings, contracted entity and transfer terms are confirmed. See Cloudflare's published D1 and R2 data-location documentation.

OpenAI / Sign in with ChatGPT

Status: identity architecture only; production account activation and the applicable provider terms remain to be confirmed.

The current application architecture can receive an authenticated user identifier, business email and display name from Sign in with ChatGPT. This authentication role does not authorise OpenAI API model processing of Customer Materials.

Stripe

Status: sandbox testing only; live checkout is not activated.

The intended functions are hosted checkout, payment status, invoicing, fraud prevention, refunds and, if separately activated, tax calculation. Stripe may act as a processor or independent controller depending on the function. PackDossier does not store full card credentials in its workspace.

Business email provider

Status: pre-launch drafts and manual business correspondence only; the production provider entity and contractual position are not yet published.

The intended data is limited to business-contact information, message content, delivery metadata, replies and suppression records. Automated supplier delivery cannot be activated until a verified sender and approved provider are recorded here.

Resend

Status: disabled candidate for transactional and supplier-request email delivery.

No production delivery is authorised by this draft. If selected, the contracted entity, sending domain, message data, processing locations and transfer terms must be verified before the delivery gate is enabled.

Document-conversion provider

Status: not selected and not activated.

A production converter may eventually receive a bounded source file to produce page, paragraph, row or image units and an attested page-one preview. No customer file may be sent to a converter until its identity, security controls, retention, locations and transfer terms are contracted and listed here.

OpenAI API model processing

Status: disabled and outside the current launch scope.

PackDossier is not currently authorised to send Customer Materials to an OpenAI model. Any future model-assisted extraction would require a separate activation decision, provider contract, data- flow review, register update and customer disclosure before use.

3. Locations and international transfers

PackDossier does not promise EU-only data residency. Blue Ridge Federal LLC is established in the United States, and a provider may process data in more than one country. Before production customer- file processing begins, this register and the operative Data Processing Addendum must identify the relevant provider locations and any required adequacy mechanism, Standard Contractual Clauses or other valid transfer safeguard.

4. Storage and provider retention

PackDossier's selected application schedule expires incomplete uploads within 24 hours, keeps free-preview source and rendered material for no more than 30 days, gives an ended workspace a 30-day export and closure window, and then starts the application-level purge. Active-service content remains under customer workspace control and is retained only while needed to provide the service. Independent encrypted backup archives, once activated, will age out within 30 days.

Provider recovery layers may retain inaccessible copies for their documented recovery period. Before production activation, PackDossier must verify that provider terms, recovery behavior and the separate backup configuration support the stated schedule. Controlled links and supplier-request channels retain their own expiry or revocation settings; billing, tax, security, dispute and suppression records follow applicable legal or operational criteria.

5. Provider changes

Candidate providers may be removed without notice because they are not authorised for production processing. Once the operative DPA is active, material additions or replacements will follow its notice and objection procedure. A page update alone will not silently authorise a provider to receive Customer Materials.

6. No certification statement

Listing a provider does not certify that provider, PackDossier, a dossier or any packaging construction. This register is not a conformity assessment, security certification, legal opinion or assurance report. PackDossier outputs remain source-backed workflow records subject to authorised human review.

7. Activation boundary

This register becomes a production register only after its version is approved, the active provider entities and data flows are verified, the operative DPA incorporates it, transfer and retention controls are documented, and the commercial processing gate is deliberately enabled. None of those events is implied by this pre-launch draft.