MIRMCSolution Web
ES
Best next:Services
Next step:Services

Procurement · privacy evidence · data flows

A code-backed view of what data-processing activities exist, which providers can participate, and where retention, residency or legal conclusions still require external evidence.

Engineering evidence — not legal certification

Traceable data flows without pretending source code is a DPA.

This is an engineering evidence map for vendor review. It is not a DPA, legal subprocessor schedule, legal opinion, controller/processor determination, SCC assessment, data-residency guarantee or proof of provider-side retention settings.

Machine-readable map
8
Activities
10
Providers referenced
31
Data classes
5
Conditional activities

Legal and residency boundary

MIRMC does not infer controller/processor roles, lawful basis, SCC adequacy, provider-side retention or a residency guarantee from repository code. Those statements need customer contracts, provider/account evidence and legal review.

Processing activities

What the architecture can evidence

identity-access

Identity and tenant access

always

Authenticate users, resolve tenant membership, enforce authorization and record security-relevant access state.

Providers
Cloudflare, Supabase
Lifecycle
security · application-policy-controlled
Residency evidence
deployment-config-dependent
Transfer boundary
provider-boundary

Data classes

account identifiersemail addressauthentication metadatamembership and role metadatarequest metadata
Repository evidence
  • src/integrations/supabase/auth-middleware.ts
  • src/integrations/supabase/auth-verification.ts
  • supabase/migrations/20260816044200_agency_saas_foundation_v1.sql
  • src/lib/enterprise-data-lifecycle.ts

agency-system-of-record

Agency system of record

always

Operate tenant workspaces, projects, clients, domains, subscriptions, governance state and business workflows.

Providers
Cloudflare, Supabase
Lifecycle
commercial · legal-contract-governed
Residency evidence
deployment-config-dependent
Transfer boundary
provider-boundary

Data classes

tenant/workspace recordsproject metadataclient contact datadomain configurationgovernance metadata
Repository evidence
  • supabase/migrations/20260816110000_agency_business_tenant_lineage_v2.sql
  • supabase/migrations/20260816110100_agency_business_tenant_rls_v2.sql
  • src/components/agency/AgencyWorkspacePortal.tsx
  • src/lib/enterprise-data-lifecycle.ts

commercial-billing

Commercial billing

feature-conditional

Create and reconcile Agency SaaS subscription checkout, billing portal and authoritative subscription state when configured.

Providers
Supabase, Stripe
Lifecycle
commercial · legal-contract-governed
Residency evidence
provider-contract-dependent
Transfer boundary
conditional-provider-boundary

Data classes

billing identifiersorganization referenceplan metadatapayer contact details
Repository evidence
  • docs/AGENCY_SAAS_STRIPE_BILLING.md
  • supabase/functions/agency-stripe-checkout/index.ts
  • supabase/functions/agency-stripe-webhook/index.ts
  • supabase/functions/agency-stripe-portal/index.ts

website-delivery-ai

AI-assisted website delivery

optional

Generate, analyze or improve selected website/business content through configured AI providers while preserving separate execution and publication authority.

Providers
OpenAI, Google / Gemini, Groq, Lovable, Supabase
Lifecycle
derived · provider-contract-dependent
Residency evidence
provider-contract-dependent
Transfer boundary
conditional-provider-boundary

Data classes

promptsselected business contentpublic website contentgenerated-content contextworkflow metadata
Repository evidence
  • src/lib/website-delivery-ai.server.ts
  • src/lib/portfolio-images.functions.ts
  • src/lib/chatbot.functions.ts
  • src/data/runtime-env-inventory.generated.ts

transactional-email

Transactional and operational email

feature-conditional

Deliver configured transactional, support and operational email messages.

Providers
Resend
Lifecycle
operational · provider-contract-dependent
Residency evidence
provider-contract-dependent
Transfer boundary
conditional-provider-boundary

Data classes

email addressmessage contentdelivery metadata
Repository evidence
  • src/lib/support-emails.server.ts
  • src/lib/automation-processor.server.ts

consultation-booking

Consultation booking

feature-conditional

Schedule consultations and synchronize booking events when the integration is enabled.

Providers
Cal.com
Lifecycle
commercial · provider-contract-dependent
Residency evidence
provider-contract-dependent
Transfer boundary
conditional-provider-boundary

Data classes

contact detailsappointment timingbooking metadata
Repository evidence
  • src/routes/api/public/hooks/calcom.ts
  • src/data/runtime-env-inventory.generated.ts

public-web-intelligence

Public web intelligence

optional

Collect public URLs and public website content for prospecting and website intelligence when invoked.

Providers
Firecrawl, Supabase
Lifecycle
derived · application-policy-controlled
Residency evidence
provider-contract-dependent
Transfer boundary
conditional-provider-boundary

Data classes

public URLspublic website contentcrawl metadataderived findings
Repository evidence
  • src/lib/prospect-agent.functions.ts
  • src/lib/digital-presence-intelligence.functions.ts
  • src/lib/enterprise-data-lifecycle.ts

audit-security-observability

Audit and security observability

always

Preserve security, audit, governance and operational evidence with bounded export and retention controls.

Providers
Cloudflare, Supabase
Lifecycle
audit · application-policy-controlled
Residency evidence
deployment-config-dependent
Transfer boundary
provider-boundary

Data classes

audit eventssecurity eventsrequest metadatagovernance decisionsoperational telemetry
Repository evidence
  • docs/ENTERPRISE_AUDIT_EXPORT_V1.md
  • supabase/functions/agency-audit-export/index.ts
  • src/lib/admin-command-security-ledger.server.ts
  • src/lib/enterprise-data-lifecycle.ts

Provider Register

Inspect the canonical integration inventory.

Trust Center

Inspect control maturity and explicit gaps.

Evidence Hub

Return to the procurement evidence index.