Data processing agreement: draft and recipient inventory

This remains a draft for VortexWeb and its legal reviewer to complete before launch. The brokerage is the intended controller and VortexWeb the intended processor. This source-derived inventory records code capabilities, not evidence that a vendor is enabled, contracted, resident in a particular country, or approved for a transfer. Last code review: 19 October 2026.

Sub-processors and configurable service providers

The owner must complete the deployed legal entity, account, actual processing/support locations, retention/deletion terms, contract and transfer safeguard for every enabled row. A UAE default in configuration is not proof that all vendor processing stays in the UAE. “Unverified” is a release blocker for an enabled provider until the controller and legal reviewer accept the evidence. Do not claim standard contractual clauses, no-training terms or a regional guarantee without the applicable agreement.

| Provider / feature | Data the code sends or makes available | Region established by code | Implemented control and required confirmation | Code evidence | | --- | --- | --- | --- | --- | | Amazon Web Services: hosting, PostgreSQL endpoint, S3 media/backups, SES email, SSM deployment/secrets; KMS where provisioned | Application records on hosting/database; uploaded photos/documents and backups; recipient email and message content for authentication, notifications and support; deployment configuration/secrets | S3 and SES default to me-central-1; database URL and actual host/account are configured. Backup/SSM scripts name AWS services; residency and support access remain unverified | Tenant-scoped application access, encrypted credentials/PII, verified database TLS, private signed media; verify deployed RDS/S3/KMS/SSM/SES regions, encryption, backups, IAM and AWS contract | [config](../../apps/api/src/config.ts), [media](../../apps/api/src/modules/media/service.ts), [mail](../../apps/api/src/lib/mail.ts), [deployment](../../infra/scripts/deploy.sh), [secrets](../../infra/scripts/fetch-env.sh), [backup](../../infra/scripts/backup.sh) | | Anthropic, managed Claude or brokerage key | Enabled AI feature's prompts, listing text/photos or allowed enquiry context; not merely usage counts | api.anthropic.com; no processing-region selection in code | Off without a configured provider/key; AI feature gate; Property Finder lead data never sent; human approval of output. Verify account contract, retention/training terms, region and transfer basis | [AI clients](../../apps/api/src/modules/ai/client.ts), [service](../../apps/api/src/modules/ai/service.ts), [lead context](../../apps/api/src/modules/ai/leads.ts) | | OpenAI, brokerage-key provider | Feature prompts, permitted context and optional photos | Default api.openai.com/v1; no region guarantee | Brokerage configuration, HTTPS/address checks; confirm account, contract and transfer terms before enablement | [clients](../../apps/api/src/modules/ai/client.ts), [egress](../../apps/api/src/modules/ai/egress.ts) | | Google, Gemini API | Feature prompts, permitted context and optional inline photos | generativelanguage.googleapis.com; processing region unverified | Brokerage key; guarded outbound transport; verify provider account/contract, retention and transfer basis | [clients](../../apps/api/src/modules/ai/client.ts), [egress](../../apps/api/src/modules/ai/egress.ts) | | Microsoft, Azure OpenAI | Feature prompts, permitted context and optional photos | Admin-configured endpoint/deployment; actual resource region unverified | Brokerage key and guarded HTTPS endpoint; confirm resource/legal entity and regional processing terms | [clients](../../apps/api/src/modules/ai/client.ts), [Liyo configuration](../../apps/api/src/modules/ai/liyo.ts) | | Other OpenAI-compatible operator selected by a brokerage (including self-hosted endpoints) | Same enabled feature payload as OpenAI-compatible requests | Configurable base URL; vendor and region cannot be enumerated from source | Record the exact operator/host in the deployed inventory before enablement; HTTPS, public-address checks and response limits are transport controls, not vendor approval | [client factory](../../apps/api/src/modules/ai/client.ts), [egress](../../apps/api/src/modules/ai/egress.ts) | | Functional Software / Sentry | Error/diagnostic events, scrubbed request metadata and user id when present; residual free-text exception content requires review | Account DSN; organization region unverified | Disabled without DSN; beforeSend drops bodies/cookies and scrubs contact/security keys and signed URLs. Confirm account region, retention, access and vendor terms | [Sentry](../../apps/api/src/lib/sentry.ts), [URL redaction](../../apps/api/src/lib/log.ts) | | Expo push service; downstream Apple APNs / Google FCM depend on the device platform | Expo device token, notification title, target type and record id, sound/priority. Titles may include listing reference/source. The generic transport accepts the supplied title; do not describe the entire payload as anonymous | Default exp.host/--/api/v2/push/send, overridable; no region control. APNs/FCM are downstream delivery providers, not direct server calls here | Token removal on DeviceNotRegistered, optional Expo authorization token. Confirm Expo and downstream provider contracts/locations; review every title source for personal data, especially PF-related metadata | [push transport](../../apps/api/src/modules/notify/push.ts), [notification titles](../../apps/api/src/modules/notify/service.ts) | | Bitrix24, when the brokerage connects its CRM | Configured contact/lead/deal/user/listing mappings and import/sync payloads; may contain contact details for permitted sources | Brokerage's webhook host, cloud or self-hosted; region unverified | Connected brokerage credentials, mapped scope and PF forwarding exclusions; confirm whether the provider is the brokerage's own processor rather than VortexWeb's sub-processor | [client](../../apps/api/src/modules/bitrix/client.ts), [bridge](../../apps/api/src/modules/bitrix/bridge.ts), [import reader](../../apps/api/src/modules/imports/bitrix-reader.ts) | | Configured static-map provider | Rounded listing coordinates, server request metadata and configured provider key | STATIC_MAP_URL_TEMPLATE; actual operator/region unknown until deployment | Optional server-side fetch and cache; identify provider, contract and location before enabling | [map rendering](../../apps/api/src/modules/brochures/render.ts), [config](../../apps/api/src/config.ts) | | GitHub / GitHub Actions, operational supply chain | Repository source, build/test logs/artifacts, authorized deployment role/session metadata; repository/environment secrets where workflows explicitly use them | Runner/account configuration; not pinned to UAE in code | Minimal workflow permissions, SHA-pinned Actions, production environment approval. Keep production records, database dumps, credentials and contact fixtures out of logs/artifacts; verify GitHub and enabled Action operators' contractual roles | [workflow](../../.github/workflows/ci.yml) |

OpenAI-compatible examples in comments (such as Groq and Mistral) are not evidence of a deployed call to those vendors. They require their own named register entry if an admin configures such a host. Stripe is a configuration enum, but there is no Stripe API client/call in the billing module reviewed here; it is not represented as an active payment sub-processor. PropSpace and Goyzer presets read uploaded files, not their vendors' APIs.

Connected recipients, browser services and data sources

These destinations are also part of the disclosure. Their role is not automatically “VortexWeb sub-processor”: some are controller-selected recipients, public data sources or independent services. The legal reviewer must settle that role and record actual deployment choices rather than silently omitting them.

| Recipient / source | Trigger and data | Region and release requirement | Code evidence | | --- | --- | --- | --- | | Property Finder | Brokerage-approved listing/media/agent and permit payloads; portal status and PF lead intake | Configured official PF host; confirm contracted processing locations. PF leads remain labelled PF, never pooled or forwarded; never sent to any AI provider | [PF modules](../../apps/api/src/modules/portals/pf), [sync](../../apps/api/src/modules/portals/sync.ts), [CRM rules](../../apps/api/src/modules/crm/rules.ts) | | Bayut / dubizzle | Brokerage-approved listing/media/agent and permit payloads, portal status and leads | Configured official Bayut API; actual contractual entity and locations require confirmation | [Bayut modules](../../apps/api/src/modules/portals/bayut), [sync](../../apps/api/src/modules/portals/sync.ts) | | Meta, Facebook / Instagram lead ads | Page/form/lead ids and access credentials on Graph calls; retrieved form answers can contain name, email and phone | Default Graph API host, configurable; account processing locations unverified. Verify brokerage authorization, lead capture notice and provider role | [Meta client](../../apps/api/src/modules/crm/sources-meta.ts) | | Customer-configured API/webhook recipients, external listing XML feeds and websites | Explicit enabled listing/lead/deal fields according to the destination; public listing feeds can include the nominated agent's business contact details | Recipient host/region varies. Register every enabled destination and agreement; PF forwarding blocks must remain enforced | [open API](../../apps/api/src/modules/openapi), [feeds](../../apps/api/src/modules/feeds/routes.ts) | | Meta WhatsApp | Human-initiated link opens WhatsApp with the intended recipient number and composed text; no automatic message send | Device/web service and recipient's account; region unverified. User confirms the handoff and send | [web handoff](../../apps/web/src/screens/whatsapp/open.js), phone link (propliyo-mobile repo, src/api/routes.ts) | | Google Fonts / Google font asset hosting | Browser IP/request metadata when an allowed font stylesheet/asset is requested; no application record payload | Global browser requests; no UAE region guarantee. Verify deployed page/network behavior and provider disclosure | [public pages](../../apps/api/src/modules/public/routes.ts), [web font references](../../apps/web/src/00-base.html), [CSP](../../apps/api/src/app.ts) | | OpenStreetMap tile service | Map tile coordinates and browser IP/request metadata on map views; listing area/location can be inferred | Public tile service, region not selected. Verify enabled map behavior and disclosure | [web maps](../../apps/web/src/00-base.html) | | Native map provider on the phone, plus human-opened Google Maps links | react-native-maps uses PROVIDER_DEFAULT to render project map locations/viewports; the map sets showsUserLocation=false. Brochure map links open Google Maps with listing coordinates or a location query when followed | Platform/build-selected native provider and Google Maps locations are unverified. Confirm the actual Apple/Google operator in each shipped build and applicable SDK/service terms; do not treat viewing check-in permission as blanket map-location consent | native map (propliyo-mobile repo, src/components/map/DubaiMapInteractive.tsx), [brochure map links](../../apps/api/src/modules/brochures/content.ts) | | Google / YouTube privacy-enhanced player, Vimeo, Matterport | Optional listing video/tour iframe loads expose visitor request metadata and the chosen content id to that provider | Player locations unverified; “nocookie” is not a regional/contractual guarantee. Review provider role and applicable notice before enabling embedded content | [allowed players and iframe](../../apps/api/src/modules/brochures/share-page.ts) | | External image/video/logo hosts selected in content; PF floorplan/image hosts | Server safe image fetches or permitted browser content requests expose server/browser request metadata and the requested asset; payload varies by feature | Host selected by content. Identify every production host; external content is not automatically an approved sub-processor. Picsum references in demo helpers are not evidence of a production storage provider | [safe image fetch](../../apps/api/src/modules/media/link-fetch.ts), [brochure photos](../../apps/api/src/modules/brochures/photos.ts), [web demo helpers](../../apps/web/src/00-base.html) | | Dubai Land Department / Dubai Pulse | Public project/sales data provenance and human-opened source/permit links; local uploaded DLD datasets do not imply an outbound personal-data submission | Source URLs name DLD/Dubai Pulse; no claim that a data supplier is a hosting sub-processor | [projects](../../apps/api/src/modules/dld/service.ts), [sales](../../apps/api/src/modules/dld/market.ts) |

VortexWeb support access

VortexWeb platform staff (superadmin) can open a brokerage's records only through a support session. The operator picks one reason (troubleshooting, onboarding, incident or demo); the session ends on its own after 30 minutes and the operator can end it sooner. Starting and ending a session are written to the brokerage's audit log. Without an active session the brokerage header is refused. Code: [support sessions](../../apps/api/src/modules/auth/support-session.ts). The brokerage agreement must state this access, its purposes and how the brokerage can see it in its audit log.

Transfer and vendor approval record

For every enabled recipient record: legal entity; service and exact endpoint/account; controller instruction and purpose; data categories and PF inclusion/exclusion; actual processing/support countries; applicable agreement and transfer mechanism approved by counsel; retention/deletion; security/contact evidence; review date, owner and next review. Keep credentials out of this record. Configurable endpoints must be reviewed whenever the host or operator changes. The code inventory cannot supply account terms or substitute for a signed agreement.

Remaining agreement sections

VortexWeb and counsel must complete processing duration/instructions, data subjects/categories, security measures, incident notice, access/audit rights, assistance with requests, sub-processor change/objection notice, retention/deletion and return at termination. This document does not assert that those terms or the cloud prerequisites have already been agreed or implemented. The release gate must verify enabled-provider evidence before launch.