Subprocessors and Supporting Providers

Effective date: 29 March 2026
Last updated: 29 March 2026

This page explains, at a public and high level, how EviWrite ("EviWrite", "we", "us", or "our") may use third-party providers to support the operation of its website, public services, verification surfaces, authorised workflows, and related systems.

This page is intended to clarify structure and categories. It is not a full infrastructure map, not a complete public vendor register, and not a substitute for any contractual documentation that may apply to authorised institutions, licensees, or approved private arrangements.

1. Why EviWrite uses supporting providers

EviWrite operates as an evidential and verification layer. That does not mean every underlying technical capability is built from scratch or operated in physical isolation.

Like other serious systems, EviWrite may rely on carefully selected third-party providers for limited technical and operational functions where that is sensible, secure, and consistent with EviWrite’s role.

The important question is not whether any third party exists. The important question is whether the role of each provider is controlled, proportionate, and bounded.

2. General position

EviWrite may use third-party providers to support functions such as:

• website and application hosting;
• infrastructure and compute;
• content delivery and edge protection;
• storage of operational or evidential records where applicable;
• security, traffic filtering, and abuse prevention;
• communications and email delivery;
• logging, monitoring, and service diagnostics;
• backup, continuity, and disaster recovery;
• blockchain or chain-interaction support where relevant to service operations.

Use of a supporting provider does not change EviWrite’s core position as the authority layer responsible for its own service role, outputs, and interpretation surfaces.

3. What “subprocessor” means here

The term “subprocessor” may be used on this page as a practical public shorthand for third-party providers that support aspects of EviWrite’s operation and may process information in that context.

Not every supporting provider necessarily performs the same legal role in every jurisdiction or relationship. Some may be processors, subprocessors, service providers, infrastructure vendors, or other forms of supporting provider depending on the exact workflow and legal framework.

This page is intended to explain operational categories, not force every situation into a simplistic label.

4. Provider categories

EviWrite may use providers within categories such as the following.

4.1 Hosting and compute infrastructure

Providers that support the running of public and restricted systems, including application hosting, compute capacity, and core service infrastructure.

4.2 Storage and retention support

Providers that support storage of service-related operational data, evidential records, backups, or other bounded information necessary to the service model.

4.3 Content delivery and edge protection

Providers that support website delivery, network resilience, caching, request routing, abuse prevention, or protective edge controls.

4.4 Security and monitoring

Providers that support logging, diagnostics, incident review, access protection, or other security-relevant technical functions.

4.5 Communications

Providers that support business or service communications, such as transactional email or operational correspondence.

4.6 Chain and evidential support infrastructure

Providers that may support blockchain connectivity, submission, validation, or related technical interaction where relevant to EviWrite’s evidential functions.

5. Public-site versus authorised-service context

Some supporting providers may relate mainly to the public website and public trust surfaces. Others may relate to restricted-access or authorised institutional workflows.

Those are not identical contexts.

A provider used to protect public traffic is not the same thing as a provider used in a private evidential workflow, and neither should be described carelessly as if it were the whole system.

6. Bounded use

EviWrite aims to use providers in a bounded way consistent with its operating model.

That means EviWrite does not treat every provider as entitled to broad, unnecessary, or open-ended access to data merely because the provider assists some part of the service.

Provider access should follow function, not convenience.

7. Role of authorised institutions and partners

Where EviWrite operates through authorised institutions, licensees, or approved third parties, those parties may use their own providers and infrastructure outside EviWrite’s direct control.

This page concerns providers used by or for EviWrite’s own service role. It does not automatically describe every third party involved anywhere in a wider partner-led workflow.

That distinction matters. The system chain may involve multiple parties, but not all of them are EviWrite subprocessors or supporting providers.

8. No public promise of exhaustive naming here

EviWrite may identify providers, categories of providers, or both, depending on what is appropriate at the time.

This page does not promise a permanently exhaustive public inventory of every vendor, endpoint, dependency, internal integration, or infrastructure component. Public completeness can quickly become operationally stale or security-naive.

Where more specific disclosure is needed for contractual or diligence reasons, that may be handled through the appropriate controlled channel.

9. Selection principles

In selecting supporting providers, EviWrite may consider factors such as:

• relevance to the actual service role;
• operational necessity;
• security posture;
• reliability;
• legal and jurisdictional fit;
• auditability;
• ability to support controlled handling of data;
• alignment with EviWrite’s bounded-data model.

The objective is not to accumulate fashionable vendors. It is to preserve service seriousness.

10. No transfer of responsibility

Use of supporting providers does not mean EviWrite stops being responsible for its own service posture.

EviWrite remains responsible for the role it chooses to perform, the public meanings it defines, and the operational discipline with which it structures its service.

A provider is support, not absolution.

11. Data categories that may be involved

Depending on the provider function, a supporting provider may process categories of information such as:

• technical access and routing data;
• service logs;
• limited account or contact information;
• bounded operational records;
• verification-related request data;
• evidential metadata, hashes, timestamps, or similar representations where relevant to EviWrite’s role;
• backup or continuity copies where required.

This does not mean every provider sees every category of data.

12. Security and confidentiality

EviWrite seeks to use providers in a way that is consistent with appropriate confidentiality, operational discipline, and security expectations for the relevant service function.

Public explanation of those arrangements is necessarily high level. Full implementation detail is not published merely because someone asks.

13. Changes over time

Supporting providers may change over time for reasons including:

• service evolution;
• infrastructure improvement;
• security posture;
• performance;
• resilience;
• legal or jurisdictional considerations;
• operational simplification.

This page may therefore be updated from time to time to reflect material changes in category, posture, or public explanation.

14. Requests for more detail

Authorised institutions, licensees, or approved parties that require more detailed subprocessor or supporting-provider information for diligence purposes may need to seek that through the correct commercial or legal channel rather than relying only on this public summary.

15. Contact

For enquiries relating to subprocessors or supporting providers, contact:

contact@eviwrite.com

Final point

The real issue is not whether EviWrite uses supporting providers. It is whether those providers are kept in their place. That is the standard that matters.