2026-05-27 · current state
Supabase (database + auth + edge functions, us-east-1 + eu-west-1) · Stripe (payments + Connect, global) · LiveKit (lesson rooms, global) · Cloudflare R2 (object storage, global) · OpenAI (engine LLM, us-east + eu-west) · Google Vertex (engine LLM + TTS fallback, us-central + eu-west) · background-screening provider (minor-teaching tutor checks, activated before minor-facing bookings) · Sentry (error monitoring, PII scrubbed) · Google Workspace (transactional email + storage, global).
2026-04-12 · Vertex added as fallback
Added Google Vertex as a fallback LLM provider behind OpenAI. 30-day notice given. No EU customer data transferred to Vertex without explicit DPO acknowledgment.
2026-03-08 · Cloudflare R2 added
Moved object storage from AWS S3 to Cloudflare R2 for cost + global egress reasons. Existing recordings migrated with no PII change. 30-day notice given.
2026-02-20 · Twilio removed
Removed Twilio (was used for SMS-based 2FA). Replaced with Supabase Auth's native TOTP. No customer data was retained by Twilio post-removal; confirmed by their retention report.
2026-01-15 · ElevenLabs (paused, not removed)
Paused use of ElevenLabs as TTS provider per owner directive (OpenAI + Vertex split). ElevenLabs retains no Koydo data per their standard purge cycle.
How we notify
Material additions trigger an email to every DPO on file 30 calendar days before deployment. Non-material changes (region rotation within a same provider, minor SDK version) do not trigger notice.