Who processes data on CiteraHub's behalf. This is a draft and has not been reviewed by a lawyer.
This list is deliberately empty of specifics. A deployment chooses its own database, hosting and mail providers, and naming one here before a deployment exists would be recording a fact that is not yet true.
What the shape will be, once a deployment exists: the database and authentication provider, the hosting and edge provider, and the transactional mail provider. Each will be named with its purpose, the categories of data it processes, and where it processes them.
Where a customer connects a provider of their own, such as a search console or a repository host, that provider is not a subprocessor of CiteraHub. The customer authorised it directly and can revoke it directly.
A qualified reviewer must confirm this characterisation before it is relied on.