# LumiPad data flow and external-provider registry

Last verified: 2026-08-26
Status: live core-provider regions verified; legal roles and contractual retention still require pilot-order review.

This registry is not legal advice and does not by itself designate every listed service as a subprocessor. Classify each service against the exact pilot configuration and signed vendor/customer terms.

## Core production path

`User browser → Vercel-hosted LumiPad → Neon PostgreSQL`

`User browser → authorized LumiPad upload/read route → Vercel Private Blob`

| Service | Purpose/data | Activation | Location/evidence to verify | Pilot action |
|---|---|---|---|---|
| Vercel | Application hosting, request/security metadata | Core | Live project setting verified 2026-08-26: Pro, Fluid Compute enabled, `iad1` (Washington, D.C., USA / `us-east-1`) | Copy region, DPA and incident contact into the signed order form |
| Neon | PostgreSQL application data | Core | Live console verified 2026-08-26: Free, AWS US East 2 (Ohio), PostgreSQL 18, six-hour history/PITR window | Internal rehearsal target RPO 6 h/RTO 30 min passed; contractual targets and DPA remain customer-approved terms |
| Vercel Blob | User attachments | Core when configured | Live Private store verified 2026-08-26: `IAD1`, Washington, D.C., USA. Dashboard exposes no retention, versioning or point-in-time recovery; record those capabilities as `unavailable` | Keep token-authorized reads; add an independent attachment replica/export before promising a file RPO |

## Optional or flow-specific services

| Service | Purpose/data | Default pilot position |
|---|---|---|
| Google Gemini API | Educator AI prompts and generated drafts/insights | **Disabled** until paid-service/DPA/eligibility and under-18 controls are confirmed |
| Google OAuth | User-directed sign-in identifiers/profile | Enable only if approved by customer |
| Zalo OAuth | User-directed sign-in identifiers/profile | Optional; requires separate network/contract review |
| Cloudflare Turnstile | Abuse signal for protected forms | Optional; document if enabled |
| YouTube | Server-side oEmbed metadata for user links | Disable link preview if not approved |
| OpenStreetMap tile providers | Map tiles requested for interactive map content | Optional; disclose browser requests or disable |
| VietQR | QR image for user-selected payment content | Optional; no school billing dependency |
| Vercel Analytics | Privacy-filtered aggregate product events | Disable or document customer-approved analytics scope |

## Data minimization and flow rules

- Do not place passwords, secrets, raw student identifiers or private content in telemetry.
- Public link previews, OAuth and optional integrations can create additional provider requests; disable unneeded routes for a pilot.
- AI routes remain educator-authorized, but that product control does not replace provider eligibility or child-data review.
- Record provider, purpose, data categories, geography, retention, contract/DPA, transfer basis and change-notice owner in the signed schedule.
- Re-verify this registry at contracting, on material provider change and at least every 120 days during a pilot.
- Record live region/retention/recovery evidence and execute the isolated rehearsal in [`disaster-recovery-runbook.md`](./disaster-recovery-runbook.md) before accepting a pilot RPO/RTO.

## Official technical/legal evidence

- Vietnam Personal Data Protection Law 91/2025/QH15: https://vanban.chinhphu.vn/?classid=1&docid=214590&pageid=27160&typegroup=
- GDPR Article 28: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
- Vercel Functions regions: https://vercel.com/docs/functions/configuring-functions/region
- Vercel Private Blob: https://vercel.com/docs/vercel-blob/private-storage
- Vercel compliance: https://vercel.com/docs/security/compliance
- Vercel DPA: https://vercel.com/legal/Vercel_Inc_-_Data_Processing_Addendum.pdf
- Gemini API terms: https://ai.google.dev/gemini-api/terms