This register describes the evidenced pilot configuration, not a claim that vendor agreements have been checked or every provider is an authorised subprocessor. The supplier is Marco Lorenzo Qureshi Grima, sole trader trading as LimitBreakIT, Malta. Questions and change notices: marco@limitbreakit.com.
Core providers in the pilot
| Service group | Purpose and potential data | Location / boundary | Contract and role review |
|---|---|---|---|
| Amazon Web Services: EC2/EBS, S3, KMS, CloudWatch, SES and supporting management services | Control-plane state, encrypted connection/hosted-key state, backups, account/operational logs, notification recipients/content and access metadata. Key management and platform operations support these functions | Primary app/backup configuration eu-west-1, Ireland. SES delivery and provider support can involve other locations | AWS is the infrastructure service group. Verify the exact contracting legal entity from the account agreement, applicable DPA, subprocessor list and transfer/access terms. For customer service data it is a candidate subprocessor; for our controller processing it is a processor. Neither role nor contract completion is inferred from an account existing |
| AWS CloudFront and static-site S3 | Public marketing assets and visitor request metadata, including IP and request path. The marketing origin is separate from app state | Global edge delivery; origin eu-west-1. Not an EU-only website delivery promise | Same AWS contract assessment; visitor processing must be covered. No claim that access logging is enabled or that provider metadata is absent |
| AWS ECR Public | Public agent binaries/image layers and public build metadata; download request metadata. No customer secrets or tenant databases belong in the image | Public registry service in us-east-1 with global downloads | Include download/registry processing in the AWS review; this exception does not move the app database to the US |
| Cloudflare authoritative DNS | Zone records, DNS queries and management/access metadata for clm.mt. Pilot records are DNS-only in retained cutover evidence | Distributed DNS infrastructure; do not apply an Ireland-only description | Verify actual Cloudflare contracting entity, DPA and DNS-specific processing/transfer terms. Not configured as app HTTP proxy in the reviewed snapshot; do not attribute proxy cookies or body inspection to DNS-only use |
Before this register is used with a customer, record the exact legal entities, applicable signed/accepted contract versions and dates, locations, downstream provider notices, transfer instruments and assessment reference in the operator record. Brand names above do not substitute for those checks. Public vendor compliance material alone is not proof that our account terms have been accepted or that our use is compliant.
Customer-selected destinations
| Destination | Data and purpose | Approval needed |
|---|---|---|
| Configured public/private certificate authority, including ACME or subscription APIs | Names, validation/order data, CSR/public keys and account contacts; public certificates may enter CT logs | Identify the actual CA, entitlement, terms, location and controller/processor role per service. Sectigo, GoDaddy and DigiCert are possible integrations, not evidence that all are active subprocessors |
| Configured DNS provider / validation server | Zones, validation names/TXT values and scoped credentials as required | Approve zone authority, provider account and data/transfer terms. Do not add all supported DNS vendors to the core list |
| Organisation identity provider | Authentication request/claims and account identifiers | Customer chooses provider and permits identity flow; review its independent role and actual destinations |
| Email, Slack, Teams or webhook recipients | Selected certificate, expiry, event and incident information | Approve recipients, minimised content, URLs, provider terms and geographic implications before enabling. A configured channel is not proof of live delivery or a signed DPA |
| Customer target systems and credential stores | Certificates, private keys where deployment needs them, connection credentials and operational results | Customer authorises the target and access. Local key handling/rollback varies by connector; identify any downstream controller/processor relationship |
The role of an issuer, identity provider or independently chosen recipient is context-specific. Do not label every recipient a processor, or assume its direct customer contract eliminates the supplier's own responsibilities.
Marketing site analytics, with consent only
| Provider | Purpose and potential data | Location / boundary | Contract and role review |
|---|---|---|---|
| Google Analytics 4 (Google Ireland Limited for EEA accounts) | Counting marketing-site page views after a visitor accepts analytics: page address and title, referrer, approximate location, device/browser details, on-page interactions and the _ga cookie identifiers. Nothing is sent before consent or after refusal or withdrawal. Advertising storage, Google signals and ad personalisation are off | Google infrastructure, including outside the EEA. Google states that Analytics does not log or store IP addresses of EU visitors | LimitBreakIT is controller for its own visitor measurement and Google acts as its processor under the Google Analytics terms and Google Ads Data Processing Terms accepted in the account, which provide the transfer safeguards. It never receives app, tenant, certificate or credential data, so it is not a subprocessor for customer service data |
Business and development systems to assess separately
The business mailbox marco@limitbreakit.com, which handles privacy, support and security enquiries, is hosted by Hostinger International Ltd (Cyprus, EU) under its terms and incorporated data processing terms. It receives enquiry content only, never a tenant data feed. Enquiries are kept for 12 months after the last meaningful contact.
GitHub private repositories/Actions, Atlassian Jira, the OCI operator workstation and its Vaultwarden service support development, issue tracking and credential custody. No automated production customer-data feed to these systems is established by this register. They can still receive operator personal data, credentials or customer information during support. Minimise and redact tickets/build logs; record their actual scope and agreements, and add them to the customer-facing register where they process customer personal data on our behalf. Public cosign transparency records contain image/signing metadata, not an authorised destination for tenant data. Do not put customer identifiers in public build annotations.
Apart from the consent-gated marketing analytics above, no payment processor, CRM, analytics, advertising or external status provider is asserted as active simply because it appears on the roadmap. No Cloudflare R2 production use is established by possession of R2 credentials.
Changes and requests
The DPA proposes 30 days' advance direct notice and an objection/exit procedure for new or replacement subprocessors. This is an adoption requirement, not a functioning self-service subscription or a record of customer consent. Keep the approved register version with each order and retain notice/objection outcomes. Tell us at the business contact if you need the approved processing scope or relevant safeguards; do not send passwords or private keys.
Vendor references, reviewed 2026-10-22: AWS contracting party, AWS privacy/GDPR information, AWS subprocessors, AWS service privacy features, Cloudflare DPA, Cloudflare privacy information. Reviewed 2026-10-23: Google Analytics data privacy, Google Analytics EU data and privacy, Google Ads Data Processing Terms. These links inform the pending account-specific assessment; no vendor text is incorporated as our executed agreement merely by linking it.