Subprocessors
Who can process MiMi data, and why.
The current subprocessor inventory is pending operations and legal review.
Inspect the evidenced pathCandidate inventory
Providers that require exact-candidate confirmation.
Vercel
Public website delivery and the browser-facing application gateway.
HTTPS requests, web request metadata, security headers, and traffic carrying the secure HTTP-only session cookie. The upload path is designed to keep archive bytes off the web application server; confirming this routing against the exact deployed configuration is part of the pre-M2 review.
Chicago private PostgreSQL
Self-hosted primary storage for bounded request and agent records used by the web boundary.
Account-linked request metadata, mandates, case status, and content-limited audit events. Raw archives are not stored in this database.
Google Gmail API
User-directed Gmail metadata discovery.
Provider account identity, encrypted token envelopes and cursors, sender addresses and domains, received timestamps, keyed message identifiers, candidate domains, counts, and last-seen dates. Discovery excludes message bodies, subject lines, recipients, attachments, drafts, and sent mail.
The candidate inventory names Chicago compute, an archive-primary plane, a Seattle archive secondary, MinIO, and Caddy. Operations and legal reviewers must confirm the exact deployed services, facilities, network providers, and data recipients before M2.
Configured, not proven active
A credential is not a delivery receipt.
Twilio Verify
Configured; real-phone delivery canary openOne-time SMS for sign-in and account recovery.
Phone number, verification status, and provider delivery metadata.
Resend
Default-off; bounded reviewed Gmail request delivery onlyOptional notification and access-request email delivery.
Recipient address, purpose-limited message, delivery state, and provider message identifier.
Apple Push Notification service
Configured; physical-device delivery canary openOptional notifications to Apple devices.
Device token and purpose-limited notification payload.
Only eligible Gmail email requests whose exact contents you reviewed and that remain unchanged may be delivered. Official forms and non-Gmail routes remain Guided for you to complete.
Inactive integration
Gmail metadata discovery is active. Microsoft mailbox discovery is not active.
Microsoft remains outside the active processor list until its exact OAuth client, scope, token storage, export, disconnect, provider revocation, and deletion canaries pass. A user-directed request to another company also does not make that company a MiMi subprocessor.
Changes
A new recipient needs a recorded purpose.
Before a new provider receives personal information, MiMi must record its purpose, data classes, location, security and deletion terms, contract status, activation evidence, and owner. The privacy notice will be updated and additional notice will be provided when applicable law or a material change requires it.
Questions about a provider