TarmacSync uses the following third-party subprocessors to provide the Service. Airport user data — procurement sessions, configuration, and conversation content — may be processed by these services as part of normal operation. This list is referenced from our Privacy Policy.
Current subprocessors
Entries marked When configured are switched on by a deployment setting and are absent from deployments that do not set it.
Neon (Database)
Purpose:
Persistent storage for airport configurations, procurement sessions, project cases, lifecycle records, audit events, and evidence packets.
Data processed:
All structured data stored by TarmacSync — see our Privacy Policy for retention details.
Document Vault Object Store (Deployment-Configured)
When configured
Purpose:
Storage of documents uploaded to the document vault.
Data processed:
Uploaded airport policy documents, grant agreements, and capital-plan attachments, with their object keys and content metadata.
Location:
DigitalOcean Spaces, United States (NYC3), in the current deployment. The client is S3-compatible, so the provider is a deployment choice rather than a code one — but naming the alternatives instead of the actual store told a reader the one thing they cannot act on.
⚠️ Confirm the storage provider and its region before enabling upload-based workflows. Uploaded documents are not covered by the database provider's agreements.
Google (Gemini AI Inference)
Purpose:
The only AI inference provider: procurement guidance, reading each message, checking answers against retrieved sources, extraction of documents uploaded during onboarding, review of documents uploaded to a purchase, reading a document uploaded on a purchase's page against the item it should settle, and rewording a drafted email on request.
Data processed:
Conversation content, airport context included in the system prompt, the text of PDFs submitted through the onboarding wizard, the text of documents uploaded to a purchase for review, documents uploaded on a purchase's page (a PDF or image is sent as a file; an email or text file as text), and drafts sent for rewording.
Capture of unhandled application errors, and of document-ingestion failures, for diagnosis.
Data processed:
Error messages, stack traces, request context, and the application's own console output at every level, which is forwarded as structured logs. That output routinely contains operational detail from the failing action — a purchase description or an airport name, for example — because a procurement error cannot be diagnosed without it. Credentials and identifiers are removed before send: bearer tokens, API keys, passwords, connection-string credentials and email addresses are redacted, and the organization identifier is hashed rather than sent. The document-ingestion worker reports under a stricter posture and excludes uploaded document text, file names and stack-frame local variables.
Tracing of AI turns for quality analysis and debugging.
Data processed:
Complete prompt and response content for traced turns, including airport context, keyed by session and signed-in user id. Email addresses and credential-shaped strings are redacted before export; retrieved document text is never recorded in retrieval steps.
Location:
Langfuse Cloud's US region, or your own infrastructure when LANGFUSE_BASE_URL points at a self-hosted instance.
⚠️ Enabling this routes complete conversation content to a new party, including the faithfulness audit's flagged claims (ADR-052). Active wherever LANGFUSE_SECRET_KEY is set (ADR-056). Retention is configurable from three days, and self-hosting keeps trace data within your own infrastructure. Not enabled for document ingestion, which makes no generative call — see ADR-025.
Upstash Redis
When configured
Purpose:
Distributed rate limiting and short-lived operational cache.
Data processed:
Rate-limit keys, counters, and short-lived operational metadata.
⚠️ Self-hosted ClamAV on the ingestion droplet; no scanning vendor receives documents. Signatures update from ClamAV's public mirrors, which receive no document data.
DigitalOcean (Hosting — Ingestion Layer)
Purpose:
Document conversion, chunking, embedding and vector storage for the ingestion pipeline.
Data processed:
Uploaded airport policy and grant documents during conversion, and their text and embeddings at rest in the vector index.
These services are not subprocessors — they store no airport data and act on nobody’s behalf. They are listed because search terms derived from what you type leave our infrastructure when they are queried.
Tavily (Web Search)
When configured
Purpose:
Vendor and market research during proactive enrichment of a path review.
Data processed:
Search query strings derived from the purchase description. No stored customer records are sent.
This list is generated from the vendor manifest the application itself is built against, so it cannot drift from the code. Material changes — new AI providers, database providers, or storage providers — will be communicated to airport pilot customers before taking effect.
Data processing agreements
DPAs are available from Neon, Resend, Langfuse, Malware Scanner, DigitalOcean, Vercel for enterprise and government customers. Contact [email protected] to request DPAs for your organization’s records. For vendors without a DPA on file, request the current terms before enabling the feature that uses them.