Draft prepared for attorney review. These documents are first drafts: they are not legal advice and have not been adopted by Varrock Inc. Points awaiting a business decision are marked [DECISION: …] and points for counsel [COUNSEL: …]; nothing here is in force.

Sub-processor and Vendor List — OasisGUI and OasisNet

Draft prepared for review by counsel on 2026-10-06. This is a first draft produced for attorney review and is not legal advice. Every factual statement about the product is traced to the oasis-gui source tree (paths relative to the repository root; the tree carries uncommitted edits, so function names are cited where line numbers may drift) or to facts supplied by the company owner. Points that need a decision by the owner or by counsel are marked [DECISION: …] or [COUNSEL: …] and are indexed in section 11.

Operating entity: Varrock Inc., a Delaware general corporation (Delaware file number 10482601). Registered agent: LegalInc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713. Commercial contact: sales@oasisgui.com.

Related documents: Privacy Policy · Data Processing Addendum · End User License Agreement · Third-Party Notices · README.

1. Purpose and scope#

1.1 This list identifies (a) every Sub-processor (as defined in the Data Processing Addendum) that Varrock Inc. ("Varrock", "we") engages to process Customer Personal Data; (b) every processor Varrock itself engages as controller for the personal data it collects in its own right; and (c) every third party the Products contact by default without a Customer decision. It is the list of sub-processors referred to in Section 4.4 and Annex III of the Data Processing Addendum and supplies the recipient information referred to in section 9 of the Privacy Policy.

1.2 OasisGUI is a desktop application and OasisNet is a mesh network; both run on machines the Customer controls. The Products have no account system, telemetry, analytics or crash reporting (verified by searching src/, src-tauri/src/ and website/ for the usual SDKs: none are present). A fresh installation has no coordination server configured (src-tauri/src/mesh_manager/mesh_config.rs:16-26), so a Customer's mesh is invisible to Varrock unless the Customer adopts a Varrock-operated coordinator. The Sub-processor chain is therefore short, and most third parties the Products can reach are engaged by the Customer with its own credentials.

1.3 The document separates four groups:

• Section 4A — Sub-processors under the Data Processing Addendum: third parties that process Customer Personal Data on Varrock's behalf. Under the Data Processing Addendum (its Section 2.3 and Annex III) the only such processing is the mobile push flow, and only once it is live.
• Section 4B — Varrock's own processors: third parties that process personal data for which Varrock is the controller (web-server logs, the sales mailbox — Data Processing Addendum Section 2.2; Privacy Policy sections 5 and 6). They are recipients for the purposes of GDPR Article 13(1)(e), not Sub-processors of any Customer.
• Section 5 — Infrastructure and distribution dependencies: third parties in the delivery chain that receive no Customer or end-user Personal Data. Listed for transparency; not Sub-processors or processors.
• Section 6 — Customer-engaged third-party services: services the Products contact from the Customer's machines, with the Customer's credentials or on the Customer's instruction. Varrock is neither controller nor processor for these.

Section 7 covers the one third party the Products contact automatically with Personal Data (api.country.is), which fits none of the four groups and needs an owner decision before publication.

2. Definitions#

"Customer", "Customer Personal Data", "Products", "Subprocessor" and "Varrock Infrastructure" have the meanings given in the Data Processing Addendum. "Sub-processor" in this list and in the Privacy Policy is the same term as "Subprocessor" in the Data Processing Addendum and the Standard Contractual Clauses.

• "Personal Data" has the meaning in Article 4(1) of Regulation (EU) 2016/679 (GDPR) and includes "personal information" under applicable United States state privacy laws.
• "User" means any person who installs or uses the Products, whether or not a Customer.
• "Varrock-Operated Service" means Varrock Infrastructure (the website and download server at oasisgui.com, the update manifest at https://oasisgui.com/downloads/latest.json and, if and when enabled, the push gateway at push.oasis.cooking) together with any coordinator or relay Varrock operates and offers to Customers [DECISION: see 3.3]. A runner contacts the push gateway only after a phone has registered that gateway's URL with it (3.5).

3. What a default installation contacts#

3.1 Update check. The desktop application requests https://oasisgui.com/downloads/latest.json a few seconds after launch and every ten minutes (src-tauri/tauri.conf.json plugins.updater.endpoints; src/UpdatePrompt.tsx:63-110). The endpoint is a literal URL without version placeholders, so the request is a plain GET carrying the client IP address, the time, User-Agent: tauri-plugin-updater/<plugin version> (2.10.1 at this draft, src-tauri/Cargo.lock) and Accept: application/json; the installed version is not transmitted. The ten-minute poll can be switched off in Settings; the single check a few seconds after launch cannot, except in Nix-managed installations, which never check (src/UpdatePrompt.tsx:63-91 is gated only by updatesManagedByNix; the interval effect at line 98 also honours the Settings toggle). [DECISION: add a setting that also disables the launch check, so the only Varrock contact of a default installation is fully optional] The website's download buttons fetch the same manifest from the visitor's browser (website/main.ts:140).

3.2 Website. The website redesign in the working tree loads no third-party fonts, scripts, analytics or content-delivery network; Mermaid diagrams are served from the site itself (website/build.sh:17-18). The currently published site (website/index.html at the last commit, lines 39-42) loads Google Fonts from fonts.googleapis.com / fonts.gstatic.com, which receive visitors' IP addresses and user-agents. [DECISION: confirm the redesign is deployed before this list is published; until then Google LLC (Google Fonts) must be listed in section 4B as a third party the website contacts] The site's nginx does not log requests for release artifacts or the update manifest (deploy/k8s/oasisgui.yaml:52-55, access_log off for dmg|msi|exe|deb|rpm|AppImage|tar.gz|tar.xz|zip|sig|json), but HTML and asset requests are logged by nginx defaults. The host-level front proxy is not configured from the repository, so its logging is unknown. [DECISION: state the access-log retention for oasisgui.com, including the host-level front-nginx]

3.3 Mesh. No coordinator or relay is built into the Products. A Customer's mesh talks only to the coordinator the Customer configures. Varrock operates coordinators and relays for its own mesh (section 8); whether they are offered to Customers determines whether their hosting providers belong in section 4A. [DECISION: does Varrock offer hosted coordinators or relays to Customers at all?]

3.4 Geo-IP lookup. The Mesh view (including the expanded device-detail row inside it) and the per-machine system-monitor dropdown show a country flag for each mesh endpoint. To do so the desktop application sends the public endpoint IP address of every displayed mesh peer to https://api.country.is/<ip> (src-tauri/src/geoip.rs, lookup). This is automatic and has no switch. See section 7.

3.5 Mobile push. The Oasis Mobile application carries a default push gateway URL of https://push.oasis.cooking (OasisMobile/Oasis/Notifications/NotificationModel.swift:195); each runner uses the gateway URL the phone registered with it and requires HTTPS (runner/oasis-runner/src/notify/push.rs, validate_gateway). The gateway forwards notifications to Apple Push Notification service. At version 2.0.0 no APNs key has been provisioned (docs/enterprise/05-operations.md; docs/mobile-notifications-design.md), so no notification is delivered and Apple receives nothing. The path becomes live the moment a key is installed. [DECISION: will mobile push go live? If yes, the gateway host becomes a Sub-processor, Apple APNs becomes a Sub-processor or an independent service, and the payload contents need disclosure] [COUNSEL: whether Apple is a Subprocessor under SCC Clause 9 or an independent service under the Apple Developer Program License Agreement — Data Processing Addendum §6.6; if the latter, move Apple to section 5 with a note that notification content reaches it]

4. Sub-processors and processors#

4A. Sub-processors under the Data Processing Addendum (Customer Personal Data)#

4A.1 The following third parties will process Customer Personal Data on Varrock's behalf once the noted condition is met. None is active at this draft, which matches Annex III of the Data Processing Addendum ("Applies only to the push flow"). Where the vendor is unnamed in the repository the row is kept with a decision marker rather than a guess.

4B. Varrock's own processors (recipients of personal data for which Varrock is controller)#

4B.1 The following third parties process personal data that Varrock collects in its own right as controller (Data Processing Addendum §2.2; Privacy Policy sections 5 and 6). They are not Sub-processors of any Customer and are not listed in Annex III of the Data Processing Addendum. They are listed here because section 9 of the Privacy Policy refers to this list for recipients.

4.2 No other Sub-processor or processor. No content-delivery network, analytics provider, crash-reporting service or payment processor is present in the Products or the website (verified by search of the repository). [DECISION: confirm that Varrock uses no support-ticketing, CRM, invoicing or payment vendor to handle Customer or prospect data outside the repository; if it does, add it to section 4B] No affiliate or group company of Varrock processes Customer Personal Data. [DECISION: confirm Varrock has no affiliates, or name any affiliate that operates shared infrastructure listed in section 8] Any such vendor must be added under section 9 before it receives Personal Data.

4.3 Transfers. Varrock is established in the United States. Where Customer Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP is transferred to Varrock, the transfer rests on the Standard Contractual Clauses (Module Two [COUNSEL: or Module Three where the Customer is itself a processor — DPA §6.2]) incorporated in the Data Processing Addendum, with the UK Addendum and Swiss amendments where they apply. Onward transfers from Varrock to a Sub-processor are made under SCC Clauses 8.8 and 9 and the written contract required by DPA §4.4. Each Sub-processor's and processor's processing location and the safeguard relied on are stated in its row; a copy of the safeguard is available from Varrock on request. [DECISION: whether Varrock is, or intends to become, self-certified under the EU-US Data Privacy Framework; the drafts assume it is not and rely on SCCs — never claim certification until done] [COUNSEL: confirm whether SCC Module Two is required for A2 while push is not live, and whether Varrock, a US entity, needs an EU representative under GDPR Article 27 — the current analysis is that Article 27(2)(a) likely exempts it]

5. Infrastructure and distribution dependencies that are not Sub-processors#

5.1 These third parties sit in the delivery chain but receive no Customer Personal Data. They are listed so that a Customer's supply-chain review has the full picture. [COUNSEL: legal entity names for section 5 and 6 vendors are taken from public sources, not the repository]

6. Third-party services engaged by the Customer#

6.1 The Products can contact the services below. In every case the contact originates from the Customer's own machine, uses the Customer's own credentials where credentials are involved, and happens only when the Customer installs, enables or uses the relevant feature. Varrock does not receive, route or store the data exchanged. These services are not Sub-processors; each is governed by its own terms, which the Customer accepts directly.

6.2 The Privacy Policy carries a plain-language version of this table under "third-party connections", beside the statement that the Products have no telemetry.

7. Automatic geo-IP lookup: api.country.is#

7.1 This is the only third party that receives Personal Data from a default installation without Customer action. Whenever a view that shows a country flag is rendered — the Mesh view (src/MeshModal.tsx:984, including the expanded device-detail row inside it, src/MeshDeviceDetail.tsx:13,196, which reads the codes the Mesh view fetched) and the per-machine system-monitor dropdown, which looks up that machine's own mesh endpoint (src/ServerStats.tsx:586-588) — the desktop application resolves each displayed peer's endpoint (a public IP address, or a host name such as the coordinator's, which is resolved to an address first) and requests https://api.country.is/<ip> to obtain a country code for the flag (src/meshIpGeo.tsx:13-27; src-tauri/src/geoip.rs, lookup and geoip_countries). Private addresses are skipped. A successful answer is cached for the life of the application process, so each address is sent once per application launch; a failed lookup is retried after ten minutes (src-tauri/src/geoip.rs:1-8,18). The request discloses the public IP address of every mesh peer — Personal Data of the Customer's users — to the operator of api.country.is, whose identity, location and retention practices are not established in the repository. The Privacy Policy §8.2 and docs/enterprise/02-security.md §5 currently describe the trigger as the Mesh view only and need the same correction (outside this document).

7.2 Because the request is initiated from the Customer's machine but is neither requested by nor disclosed to the Customer, it does not fit section 6; because the operator is unknown and has no contract with Varrock, it is not a Sub-processor under section 4. One of three resolutions must be chosen before the Privacy Policy is published:

• (a) keep the lookup and disclose api.country.is as a third party that receives peer IP addresses, after identifying its operator and terms;
• (b) gate the lookup behind an off-by-default setting; or
• (c) remove the lookup or replace it with an offline country database.

[DECISION: choose (a), (b) or (c) for api.country.is before the privacy notice is published] [COUNSEL: (i) whether Varrock, as designer of a default-on feature that discloses third parties' IP addresses, is a controller or joint controller for the disclosure (CJEU C-40/17 Fashion ID; C-210/16 Wirtschaftsakademie), independent of the Customer's role; (ii) if (a) is chosen, whether disclosure suffices or a legal basis under GDPR Article 6(1)(f) with a documented balancing test is needed; (iii) whether (b) off-by-default is the only option that avoids (i)]

8. Varrock-side hosts and products outside this list#

8.1 The repository configures several hosts and a separate product that are not part of delivering the Products or Varrock Infrastructure. They are recorded so counsel can confirm the boundary.

9. Change notification mechanism#

9.0 Incorporation and precedence. This list is incorporated into the Data Processing Addendum as the list referred to in its Section 4.4 and Annex III. It is a disclosure; obligations between Varrock and a Customer arise only under the Data Processing Addendum, and in case of conflict that Addendum prevails (its Section 8.2). Nothing in this section creates a right or obligation that the Data Processing Addendum does not.

9.1 Where the list lives. The authoritative version is published at [DECISION: canonical URL, e.g. https://oasisgui.com/legal/subprocessors] and maintained in the repository at docs/legal/subprocessors.md. Each published version is dated in section 10.

9.2 What counts as a change. Adding or replacing a Sub-processor in section 4A; materially changing the Customer Personal Data a Sub-processor can access or the country in which it processes; promoting a conditional entry (A1, A2, A3) to active; or adding a new default-contact third party of the kind in section 7. Changes to sections 4B, 5, 6 and 8 are informational, do not trigger the notice period, and are still recorded in section 10.

9.3 Advance notice. Under the Data Processing Addendum, Varrock gives Customers that have signed it the prior notice that its Section 4.4 requires (thirty (30) days at this draft) before a new or replacement Sub-processor begins processing Customer Personal Data, by the channel that Section 4.4 designates. [DECISION: notice channel — decide once, in DPA §4.4, and mirror it here; recommended: e-mail to the DPA contact plus this page] [DECISION: whether to also offer a subscription mechanism — a mailing list or an RSS/Atom feed of this page — so Customers without a DPA can follow changes]

9.4 Emergency replacement. This list grants no right to replace a Sub-processor without prior notice. [COUNSEL: whether an emergency-replacement clause (replacement first, notice within N days, objection and termination right preserved) should be added to DPA §4.4; it must be consistent with SCC Clause 9(a) Option 2 and cannot be introduced through this list alone]

9.5 Right to object. A Customer that has signed the Data Processing Addendum may object to a new Sub-processor on reasonable, documented data-protection grounds within the notice period; the procedure and termination right are in that Addendum. Because the Products run on the Customer's own infrastructure, the practical remedy is usually to keep using the Products without the affected Varrock-Operated Service (switch off the update poll — the launch-time check still runs, see 3.1 — self-host the push gateway, or decline a Varrock-run coordinator).

9.6 Verification. docs/enterprise/02-security.md §5 lists the principal outbound flows and the setting, if any, that disables each; this list is the complete inventory and is reconciled with that section at every change. [DECISION: extend 02-security.md §5 to the section 6 destinations it omits (install scripts, ElevenLabs, IP/time-zone probes, image mirrors, WebView2) or reference this list from it]

9.7 Before onboarding. Under the Data Processing Addendum §4.4, Varrock binds each Sub-processor by written contract to data-protection obligations no less protective than those in the Addendum before it receives Customer Personal Data, records it in section 4A, and puts the transfer mechanism in place where it processes outside the EEA, the United Kingdom or Switzerland. Varrock remains responsible for each Sub-processor's performance; the Customer is responsible for the section 6 services it engages directly.

10. Version history#

11. Open decisions#

Every marker in this document is indexed below; the exact text is at the section cited and can be found with grep -n 'DECISION\|COUNSEL' docs/legal/subprocessors.md.

Owner decisions

1. Whether Varrock offers hosted coordinators or relays to Customers at all — 2 (Varrock-Operated Service), 3.3, A3.
2. Add a setting that also disables the launch-time update check — 3.1.
3. Confirm the website redesign (no Google Fonts) is deployed before this list is published; until then Google LLC stays in 4B — 3.2, B3.
4. Access-log retention for oasisgui.com, including the host-level front-nginx — 3.2.
5. Whether mobile push will go live, which makes the gateway host a Sub-processor and Apple APNs a Sub-processor or independent service, and requires payload disclosure — 3.5, A2 (list now as conditional, or only when live).
6. Hosting provider, datacenter country and contracting entity for oasis.cooking — A1, B1.
7. Access-log retention for push.oasis.cooking — A1 (mirrors DPA Annex I).
8. Contracting entity and contract under which relic is leased from Worldstream — A3, 8.
9. Whether hosted coordinators/relays, if offered, are added to DPA §2.3 and Annex III, or relic moves to section 8 — A3.
10. Confirm written data-processing agreements exist with the hosting provider and the mailbox provider — B1, B2.
11. Mailbox provider and country for sales@oasisgui.com — B2.
12. Confirm no support-ticketing, CRM, invoicing or payment vendor handles Customer or prospect data outside the repository — 4.2.
13. Confirm Varrock has no affiliates, or name any affiliate operating shared infrastructure in section 8 — 4.2.
14. Whether Varrock is, or intends to become, self-certified under the EU-US Data Privacy Framework — 4.3.
15. Certificate issuer for oasisgui.com — I1.
16. Whether the iOS app is distributed to Customers — I3.
17. Registrar and DNS provider for oasisgui.com and oasis.cooking — I6.
18. Confirm WireGuard LLC's location — I7.
19. Resolution (a), (b) or (c) for api.country.is before the privacy notice is published — 7.2.
20. Confirm relic is internal infrastructure and note its shared-tenant situation — 8.
21. Confirm main.zone is the Worldstream k3s-01 box and whether it still serves any Oasis role — 8.
22. Contracting entity for the Hetzner hosts — 8.
23. Confirm mp1/mp2 are not product-delivery infrastructure — 8.
24. Whether MailMux is published under Varrock (if so, it needs its own list) — 8.
25. Confirm the Founder app is outside this list — 8.
26. Canonical URL for the published list — 9.1.
27. Notice channel for Sub-processor changes — decide once in DPA §4.4 and mirror here — 9.3.
28. Whether to offer a subscription mechanism (mailing list or feed) for changes — 9.3.
29. Extend docs/enterprise/02-security.md §5 to the section 6 destinations it omits, or reference this list from it — 9.6.

Counsel decisions

30. Whether Apple APNs is a Subprocessor under SCC Clause 9 or an independent service under the Apple Developer Program License Agreement (DPA §6.6) — 3.5, A2.
31. Whether personal data collected directly by a US controller and then handed to a US processor engages Article 46 at all (EDPB Guidelines 05/2021) — B1, B2.
32. Whether embedding Google Fonts makes Varrock a controller for the disclosure of visitor IP addresses to Google — B3.
33. Whether SCC Module Three is needed where the Customer is itself a processor (DPA §6.2) — 4.3.
34. Whether SCC Module Two is required for A2 while push is not live, and whether Varrock needs an EU representative under GDPR Article 27 — 4.3.
35. Legal entity names for section 5 and 6 vendors are taken from public sources, not the repository — 5.1.
36. Moonshot AI's processing location — U2.
37. For api.country.is: (i) whether Varrock is a controller or joint controller for the disclosure (Fashion ID); (ii) if kept, whether disclosure suffices or an Article 6(1)(f) basis with a balancing test is needed; (iii) whether off-by-default is the only option that avoids (i) — 7.2.
38. Whether an emergency-replacement clause belongs in DPA §4.4, consistent with SCC Clause 9(a) Option 2 — 9.4.

Varrock Inc. · Draft 0.2 · 2026-10-06 · Prepared for attorney review; not legal advice.

Source: docs/legal/subprocessors.md in the repository · draft for attorney review · 39 [DECISION] markers and 11 [COUNSEL] markers on this page.