Subprocessor Register

Last updated: August 18, 2026

This register distinguishes active production processors from planned integrations. A planned provider does not receive applicant data until it is contracted, configured, disclosed, and activated.

Provider	Purpose and data	Status
Cloudflare, Inc.	DNS, CDN, security, Pages/Workers execution, D1 operational records, KV session data, and private R2 documents when enabled	Active
Plaid Inc.	User-authorized bank connection; account, identity, balance, transaction, and connection metadata	Planned; not active in the public funnel
Communication/CRM provider	Lead contact and workflow notification data	Not selected or active
Document intelligence provider	Statement/contract extraction, reconciliation, and fraud review	Not selected or active
Google advertising services	Click identifiers and qualified/funded conversion outcomes, subject to required consent and policy	Not active

Applicant information is not sent to Mobbin, Higgsfield, or other tools used solely to research or produce non-applicant website design assets.