Draft 0.3 · issued 19 August 2026 · customer-file service unavailable

Service providers and subprocessors

No provider is currently authorised to receive EU-directed Customer Materials. This transparency register distinguishes website and test services from providers contracted for customer-file processing. Customer files remain unavailable until every receiving provider, location, role and transfer safeguard is verified and the operative DPA is available.

Blue Ridge Federal LLC, trading as PackDossier, publishes this page to distinguish providers used for public-site or test operations from providers authorised to process Customer Materials. The operator is registered with the New York Department of State, Division of Corporations under New York DOS ID 7832662 and UEI RFZ3TK7E35P6. Questions may be sent to support@blue-ridge-federal.com.

1. How to read this register

Public-site or test only means the provider may support development, authentication, website delivery or sandbox testing, but is not approved by this page to receive Customer Materials.
Disabled means the integration exists only as code or a planned capability and cannot send or receive Customer Materials.
Customer-file processor means the provider will be used only after its entity, purpose, data categories, locations, contract and transfer position are verified and this register is updated.

2. Current provider inventory

Cloudflare infrastructure

Status: public-site infrastructure; not authorised by this register to receive Customer Materials.

Intended functions include network delivery, application hosting, private database storage and private object storage. Request metadata and IP addresses may be processed when a hosted site is accessed. The selected D1 database and R2 object-storage configuration uses Cloudflare's automatic placement, without an EU jurisdiction restriction. Cloudflare chooses a primary placement for each resource and may serve requests through its distributed network. This is not an EU-only residency commitment. Account records and Customer Materials may be processed only after the relevant bindings, contracted entity and transfer terms are confirmed. See Cloudflare's published D1 and R2 data-location documentation.

OpenAI / Sign in with ChatGPT

Status: account identity only; the applicable provider terms for customer-file service remain to be confirmed.

The current application architecture can receive an authenticated user identifier, business email and display name from Sign in with ChatGPT. This authentication role does not authorise OpenAI API model processing of Customer Materials.

Stripe

Status: test mode only; live checkout is unavailable.

The intended functions are hosted checkout, payment status, invoicing, fraud prevention, refunds and, if separately configured, tax calculation. Stripe may act as a processor or independent controller depending on the function. PackDossier does not store full card credentials in its workspace.

Business email provider

Status: manual business correspondence only; the customer-file provider entity and contractual position are not yet published.

The intended data is limited to business-contact information, message content, delivery metadata, replies and suppression records. Automated supplier delivery cannot be used until a verified sender and approved provider are recorded here.

Resend

Status: disabled candidate for transactional and supplier-request email delivery.

No customer-file delivery is authorised by this draft. If selected, the contracted entity, sending domain, message data, processing locations and transfer terms must be verified before delivery begins.

Document-conversion provider

Status: not selected and not in use.

A customer-file converter may eventually receive a bounded source file to produce page, paragraph, row or image units and an attested page-one preview. No customer file may be sent to a converter until its identity, security controls, retention, locations and transfer terms are contracted and listed here.

OpenAI API model processing

Status: disabled and outside the current launch scope.

PackDossier is not currently authorised to send Customer Materials to an OpenAI model. Any future model-assisted extraction would require a separate operator decision, provider contract, data- flow review, register update and customer disclosure before use.

3. Locations and international transfers

PackDossier does not promise EU-only data residency. Blue Ridge Federal LLC is established in the United States, and a provider may process data in more than one country. Before EU-directed customer- file processing begins, this register and the operative Data Processing Addendum must identify the relevant provider locations and any required adequacy mechanism, Standard Contractual Clauses or other valid transfer safeguard.

4. Storage and provider retention

PackDossier's selected application schedule expires incomplete uploads within 24 hours, keeps free-preview source and rendered material for no more than 30 days, gives an ended workspace a 30-day export and closure window, and then starts the application-level purge. Active-service content remains under customer workspace control and is retained only while needed to provide the service. Independent encrypted backup archives, when in use, will age out within 30 days.

Provider recovery layers may retain inaccessible copies for their documented recovery period. Before customer-file service begins, PackDossier must verify that provider terms, recovery behaviour and the separate backup configuration support the stated schedule. Controlled links and supplier-request channels retain their own expiry or revocation settings; billing, tax, security, dispute and suppression records follow applicable legal or operational criteria.

5. Provider changes

Candidate providers may be removed without notice because they are not authorised for customer-file processing. Once the operative DPA is active, material additions or replacements will follow its notice and objection procedure. A page update alone will not silently authorise a provider to receive Customer Materials.

6. No certification statement

Listing a provider does not certify that provider, PackDossier, a dossier or any packaging construction. This register is not a conformity assessment, security certification, legal opinion or assurance report. PackDossier outputs remain source-backed workflow records subject to authorised human review.

7. When this register applies

A provider may receive Customer Materials only after this version is adopted, its legal entity and data flow are verified, the operative DPA incorporates it, and the applicable transfer and retention controls are documented. Publication alone does not authorise any provider to receive Customer Materials.