Vendor & Third-Party Management
1. How vendors are chosen
We use established providers with published security programmes and data processing terms. We share with each vendor only the data it needs, and review the list every year or when a vendor changes.
2. Current vendors
| Vendor | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting (Workers), file storage (R2), DNS, email routing | All application traffic; stored files; encrypted integration keys |
| Supabase | Database and sign-in | Organization records, accounts |
| GitHub | Source code, automated checks | Code only, no customer data |
| Optional sign-in, Drive, Calendar and Meet | Only what an officer connects | |
| Zoom | Optional meeting scheduling | Meetings Koana creates |
| Meta (Facebook, Instagram, Threads) | Optional posting from Koana Commons | Posts an officer chooses to publish |
| OpenAI | Automated safety check of messages and photos, in organizations where Messages checks are on (see Messaging Guidelines) | The text or photo being checked, and nothing else from the conversation. Text only when Koana's own check cannot run; photos always |
| Google Gemini | Optional AI assistance | Paid tier only; member data is never sent to free tiers |
| Open-Meteo | Weather forecasts, ensemble forecasts, historical weather and place search. Weather data by Open-Meteo, licensed CC BY 4.0 | Rounded place coordinates, and the town or venue text typed for a place so it can be found; never member or event details |
| NASA GPM IMERG (GES DISC) | Satellite rain estimates around an event's place on the day (GPM IMERG Early, NASA Goddard Earth Sciences Data and Information Services Center) | Rounded place coordinates only |
| OpenStreetMap (Nominatim) | Finding a typed venue's exact spot for its weather. Map data © OpenStreetMap contributors, ODbL | The typed venue text and country only — no organization, member or event |
| US National Weather Service | Official weather alerts for places in the United States (public data from weather.gov) | Rounded place coordinates only |
3. Ongoing management
- Vendor security notices are monitored.
- Integration permissions are kept to the minimum needed.
- If a vendor is breached in a way that affects Koana, our incident response applies.