Explain who else receives the data

An application’s data flow connects to a processor and subprocessor with their processing regions recorded.

Explain who else receives the data

A provider name alone does not explain who receives personal data. Wildo gives the application a processor register for the actual arrangement: the legal entity, processing locations and the next organizations in the chain.

Entries can be connected to configured providers or describe other operator-managed relationships. That makes the register useful both for technical coherence and for preparing a clear recipient disclosure.

Example — Follow an email beyond the application

An application sends account emails through a provider. Its register identifies the processor and relevant locations, while the configured-provider reference connects that disclosure to the service the application actually uses.

For engineers

Choose the right kind of entry

The canonical schema makes configured providers and separately authored relationships distinct. Both carry the same identity fields; only the provider-backed kind can be joined to application configuration. Selected schema declarations from processor-register.schemas.ts:

const ProcessorIdentityFieldsSchema = z.object({
  legalEntityName: z.string().trim().min(1),
  processingRegions: z.array(z.string().trim().min(1)).min(1),
  subprocessors: z.array(ProcessorSubprocessorSchema),
});

export const ApplicationProcessorDeclarationSchema = z.discriminatedUnion("kind", [
  ProcessorIdentityFieldsSchema.extend({
    kind: z.literal(ProcessorRegisterEntryKind.CONFIGURED_PROVIDER),
    providerRef: z.string().trim().min(1),
    purpose: z.string().trim().min(1).optional(),
  }).strict(),
  ProcessorIdentityFieldsSchema.extend({
    kind: z.literal(ProcessorRegisterEntryKind.AUTHORED),
    subprocessorRef: z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
    purpose: z.string().trim().min(1),
  }).strict(),
]);

Reconcile both directions

The helpers below show the result the drafting lane can inspect. The register is a typed specification family, loaded from the application’s specification exports.

The companion supplies runtime-bound provider references and the operator’s deployment choices. It excludes explicitly self-hosted providers before comparing recipient candidates with the register; an unanswered deployment choice stays visible as a question.

// Selected companion reconciliation; all inputs have already been loaded.
const operatorRunRefs = new Set(
  Object.entries(choices ?? {})
    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED)
    .map(([providerRef]) => providerRef),
);
const recipientCandidateRefs = configuredProviderRefs.filter((ref) => !operatorRunRefs.has(ref));
const missing = undeclaredProcessorRefs(recipientCandidateRefs, register);
const stale = processorRefsNotConfigured(recipientCandidateRefs, register);
const regions = processorProcessingRegions(register);

The reconciliation helpers are exported from @wildo-ai/saas-specifications. missing identifies candidates without entries, not proof that each is vendor-hosted. stale identifies provider-backed entries outside that candidate set. regions includes declared subprocessors. Profile-only providers never enter the runtime-bound input. Separately authored relationships require their own declaration because configuration cannot establish them.

Record the arrangement, not a brand assumption

A configured-provider entry carries kind, providerRef, legalEntityName, processingRegions and subprocessors; authored entries use subprocessorRef and a required purpose. An empty register records the operator’s declaration of no processor recipients, which must still be reconciled against candidates; an absent register has not made that statement. Provider deployment choices determine whether an external recipient exists at all. Verify the operator’s actual contract and source disclosures before publication; schema validation establishes consistency, not the truth of a vendor’s current arrangements.

Explain who else receives the data