Takos Docs

テーマ切替

Legal: Sub-processor List ​

このページでわかること: Takos が Customer Personal Data の処理で利用する sub-processor / third-party processor、目的、data category、optional provider の扱い、vendor onboarding rule。

This list is the public baseline for the Takos DPA template. It is not a complete vendor risk file; private vendor security reviews, contract records, and billing evidence stay in the operator's approved private evidence store.

Status ​

FieldValue
OwnerData protection owner
Last reviewed2026-05-07
Applies toTakos Web / API, Takosumi Accounts (identity / billing processor), Takosumi/operator-managed deploy/runtime operations used by Takos spaces, Git service profile, agent runtime profile
Related DPA/legal/data-processing-agreement
Change notice targetAt least 30 days before new production processing where Customer notice rights apply

Internal processor boundary note. Within the Takosumi / Takos ecosystem itself, Takosumi kernel is treated as the Capsule / typed Runs / StateVersion / Output run-ledger processor and never holds identity, billing, or customer account state. Takosumi Accounts (takosumi.identity.oidc / takosumi.billing.usage) is the separate identity / billing processor that owns OIDC issuance, Capsule ownership, and operator BillingPort billing. External sub-processors below are referenced by both planes only when the relevant feature is enabled.

Core Providers ​

ProviderRolePurposeCustomer Personal Data categoriesLocation / region behaviorOfficial source
Cloudflare, Inc. and affiliatesHosting / edge compute / storage / security processorTakos Web / API hosting, Workers, D1, R2, KV, Queues, CDN / WAF, logs, and Cloudflare distribution operationsAccount identifiers, session metadata, request metadata, source artifacts, runtime logs, object storage, deployment metadataCloudflare global service; provider sub-processor list is maintained by CloudflareCloudflare sub-processors
OpenAI OpCo, LLC / OpenAI Ireland Ltd.AI model processorLanguage model inference, embeddings, agent response generation, and AI feature support when enabledPrompts, messages, tool context, files or content submitted to AI features, generated outputs, request metadataOpenAI DPA identifies entity / transfer handling by customer region and refers to its sub-processor listOpenAI DPA
Stripe, Inc. / Stripe Payments Europe, LimitedPayment processor and payment controller depending on activitySubscription billing, invoices, payment status, fraud prevention, tax and payment complianceBilling contact data, email address, customer ID, subscription status, usage and invoice metadata; card numbers are handled by Stripe, not stored by TakosStripe DPA and services agreement define regional contracting entity and transfer termsStripe DPA
Google LLC / Google Ireland LimitedIdentity provider, optional AI provider, optional Google Cloud hosting processorGoogle OAuth sign-in; optional Google AI API use; optional GCP / GKE hosting target where selected by operatorOAuth subject, email, name, avatar; optional AI prompts / outputs; optional deployment artifacts and logs for GCP-hosted deploymentsGoogle Cloud location behavior follows selected services and regions; Google publishes DPA and sub-processor termsGoogle Cloud DPA, Google Cloud sub-processors
Amazon Web Services, Inc. and AWS affiliatesOptional infrastructure processorOptional AWS staging / production target, S3-compatible storage, Route53, CloudWatch, SES / SNS where enabledDeployment artifacts, object storage data, routing metadata, logs, alerts, support data shared by operatorProcessing follows selected AWS Region plus AWS service-provider and support subprocessorsAWS DPA, AWS sub-processors

Optional / Customer-selected Processing ​

The following are not automatically authorized for every customer. They become in scope only when Customer, operator, or a Takos app configuration enables the feature:

Provider classExample triggerHandling rule
Customer app integrationsCustomer installs an app, MCP server, OAuth client, webhook, or external API integrationCustomer owns the integration choice; Takos must show the integration boundary in product UI / docs
Customer-selected deployment targetCustomer or operator deploys a Takos space to AWS, GCP, Kubernetes, self-hosted infrastructure, or another targetTarget provider must appear in the signed order / deployment profile and this list before production personal-data processing
AI provider overrideCustomer configures non-OpenAI model provider or custom OPENAI_BASE_URL equivalentVendor review and sub-processor list update required before Takos-managed production use
Support toolsCustomer submits support tickets, diagnostics, or incident evidence to a separate support systemTool cannot receive Customer Personal Data until vendor review and DPA coverage are complete

Not Sub-processors by Default ​

SystemReason
GitHub Actions for OSS repository CIProcesses source and CI metadata for Takos development, not customer production personal data by default
JSR package registryDistributes packages; no Takos customer production personal data is sent by default
Customer self-hosted databases / object storesControlled by Customer or operator deployment choices, not a Takos-managed sub-processor unless Takos operates them for Customer
Prometheus / Grafana in self-hosted observabilityDeployment-local tooling unless Takos uses a managed third-party observability vendor

Vendor Onboarding Rule ​

Before a new provider processes Customer Personal Data in a Takos-managed production environment, the service owner must:

  1. Record provider name, service owner, feature trigger, processing purpose, data categories, regions, and official legal / security source links.
  2. Confirm whether the provider acts as processor, sub-processor, independent controller, or mixed-role provider.
  3. Complete privacy and security review and store evidence privately.
  4. Confirm DPA / SCC / transfer mechanism coverage where required.
  5. Update this list and notify affected customers according to the signed DPA.
  6. Add rollback or provider-disable instructions for the affected feature.

Provider source links reviewed on 2026-05-07: