1. Current intended service chain
CodeTutor minimizes cloud records, but a managed service still requires specialized infrastructure. The following providers are present in the production design; activation and region details must be verified before commercial launch.
| Provider | Purpose | Typical data |
|---|---|---|
| Supabase | Authentication and account database | Identity, profile, sessions, preferences, learning sync, usage and ledger records |
| Vercel | Hosted web/cloud functions and AI Gateway routing | Request metadata and transient managed-AI request content needed for generation |
| Upstream model providers | Generate the model response selected by the user | Transient prompt context and necessary repository excerpts |
| Stripe | Checkout, subscription, tax, invoices, refunds and disputes | Customer, transaction, tax and payment records; CodeTutor does not receive full card details |
| Resend | Custom authentication and transactional email | Email address, delivery metadata and message content |
| GitHub | Source hosting, releases, issue/support workflow and optional OAuth | GitHub identity and activity when those features are used |
2. Model choice
The selected model determines the upstream provider that processes a managed-AI request. CodeTutor must show the actual model identity and should not silently switch to another paid model. If a compatible fallback is offered, user approval and relevant price information are required.
3. Changes
Before adding a production subprocessor, CodeTutor should document its purpose, data boundary, security posture, retention, regional availability, and contractual role. Material changes require a new update date and an appropriate user notice.
4. Missing launch details
Final legal entity names, processing regions, transfer mechanisms, data-processing terms, and advance-notice period are not yet verified. They remain commercial launch blockers rather than being inferred here.