Document record
The current version of this document.
- Record
- ASCA Public Legal Record · 2025.08
- Applies to
- Users, Organizations, and Data Protection Contacts
- Acceptance context
- Applies Through the Governing Terms and Service Context
- Effective and updated
- August 12, 2025
- Version history
- Replaces the January 28, 2025 version
Effective policy. This document is effective August 12, 2025. Replaces the January 28, 2025 version.
Why ASCA uses providers
ASCA uses independent providers for limited functions needed to operate, secure, support, and improve services. Provider selection and internal routing may change. ASCA describes public data handling by function and purpose rather than publishing confidential infrastructure architecture.
Provider categories
| Category | Limited function |
|---|---|
| Hosting and delivery | Run web applications, route traffic, and deliver public assets |
| Cloud infrastructure and storage | Private compute, object storage, backups, and recovery |
| Database and cache | Store scoped operational records and bounded service state |
| Identity and authentication | Sign-in, account verification, and security controls |
| Communications | Transactional email, notices, and requested messages |
| Billing and payment | Subscription, checkout, payment status, refunds, and reconciliation |
| Security and diagnostics | Availability, error classification, incident detection, and abuse prevention |
| Content-safety processing | Authorized moderation and conflict-analysis functions |
| File safety and extraction | Malware review and bounded processing of supported files |
| Support and operations | Authorized case handling and service administration |
Provider requirements
ASCA expects providers handling personal information to:
- Process information only for limited and documented purposes.
- Apply confidentiality and appropriate security.
- Restrict personnel and service access.
- Notify ASCA when they can no longer meet applicable obligations.
- Support deletion, return, incident, and rights workflows where required.
- Avoid unrelated use, sale, advertising, or model training of customer content unless separately and expressly authorized.
ASCA uses configuration, contractual restrictions, scoped credentials, and technical boundaries to limit provider access and independent retention where supported.
Provider transparency
ASCA publicly describes the functions for which service providers may process information. Confidential implementation and security architecture is not part of this public notice.
This does not override a lawful transparency obligation. Eligible commercial customers may receive an approved named subprocessor schedule and material change process under their Data Processing Addendum.
Connected services
Discord, Twitch, identity services, payment services, and other services that a user or organization chooses to connect may independently determine their own processing. They are not ASCA subprocessors for every purpose merely because an integration exists.
Changes and contact
Material changes to processing purpose or risk require review and applicable notice. Questions may be sent to [email protected].