Third-party register
Every external provider Siglos depends on, with criticality, contract status and data-protection posture.
This is the seed of your DORA Register of Information.
DORA requires financial-entity clients to maintain a register covering their full ICT supply chain —
which includes what Siglos itself depends on. Maintaining it from day one is materially easier than
reconstructing it from memory when a bank asks.
Registered providers
5
DPA required, not in place
3
legal action — route to LEXR
On a personal account
4
must move to the company at incorporation
| Ref | Provider | Service | Location | Criticality | Contract | DPA | PII |
|---|---|---|---|---|---|---|---|
| TP-001 | Cloudflare Personal account until incorporation. Migration item M-2. |
DNS, WAF, Access, Workers, Hyperdrive | US / global edge | critical | personal account | required not in place | yes |
| TP-002 | Swiss VPS provider Chosen for Swiss jurisdiction. Migration item M-3. |
Virtual private server hosting | CH | critical | personal account | required not in place | yes |
| TP-003 | GitHub (Microsoft) Org siglos-ag on Team plan. Migration item M-1. |
Source control, CI, issues | US | critical | personal account | required not in place | yes |
| TP-004 | Anthropic Cowork not covered by audit logs - see DOC-001. |
AI review agents (Claude) | US | important | personal account | under review | no |
| TP-005 | n8n GmbH No vendor data flow: software runs entirely on our VPS. |
Workflow engine (self-hosted) | DE / self-hosted | supporting | none | not required | no |