Sub-processors

We engage the following sub-processors to deliver core parts of the Honor Flight App Services. Each sub-processor only processes personal data as necessary to provide its service to us and is bound by confidentiality and security obligations.

Current Sub-processors

• Amazon Web Services, Inc. (AWS) — Cloud infrastructure and storage (hosting, databases, backups, networking). Data processed: Customer Data at rest/in transit within our cloud environment, logs, and backups. Primary regions: United States.
• Upstash, Inc. — Serverless Redis (cache/queue). Data processed: keys and values required for application caching, rate limiting, and job coordination; may include user or request identifiers as configured. Retention: transient caching with short TTLs; no long-term storage of message content in cache. Primary regions: United States.
• Google LLC — Authentication (OAuth) for Users who choose Google sign-in. Data processed: identity tokens and basic profile attributes (e.g., name, email) necessary to authenticate accounts.
• GitHub, Inc. — Authentication (OAuth) for Users who choose GitHub sign-in. Data processed: identity tokens and basic profile attributes (e.g., name, email) necessary to authenticate accounts.
• Apple Inc. — Authentication (Sign in with Apple) for Users who choose Apple sign-in. Data processed: identity tokens and basic profile attributes necessary to authenticate accounts.
• Twilio Inc. — SMS messaging delivery. Data processed: phone numbers, message metadata, and message content to the extent required to route and deliver operational notifications; carrier delivery receipts.
• Resend, Inc. — Transactional email delivery. Data processed: sender/recipient addresses, email metadata, and message content to the extent required to compose, route, and deliver messages; delivery status.

Changes to this List

Open Source Components

We rely on open source software. These projects are not sub-processors (they don’t process data as independent vendors), but we list key components for transparency along with their current licenses.

• Next.js (Vercel) — Web framework — License: MIT.
• React / React DOM (Meta) — UI library — License: MIT.
• Drizzle ORM — Database ORM — License: Apache-2.0.
• Postgres.js — Database driver — License: ISC.
• Zod — Validation — License: MIT.
• NextAuth.js — Authentication — License: ISC.
• HeroUI / NextUI — UI components — License: MIT.
• Tailwind CSS — Styling — License: MIT.
• Vitest / Testing Library — Testing — License: MIT.
• Expo / React Native (mobile-app) — Mobile framework — Licenses: MIT (React Native), Expo SDK under MIT-compliant licenses.
• Zustand — State management (mobile) — License: MIT.
• TanStack Query — Data fetching (mobile) — License: MIT.

We may update this list as our Services evolve. For material changes, we will provide reasonable advance notice to Customers (for example, via email or in-app notice). Customers may object to a new sub-processor on reasonable grounds pursuant to our DPA.