Vendor packet

01The register

Organized the same way the trust center itself is: reliability, regulatory compliance, data privacy, and platform security. Every document below carries its own draft banner on its own page — the status column here is a summary, not a separate assertion.

Availability

Compliance

Privacy

Security

02Certifications and audits

Stated directly, because a vendor-risk review asks for this specifically and a missing row would read as an oversight rather than an honest answer:

03Subprocessors

The approved subprocessor register is currently empty — zero rows. That is an accurate statement about which vendors have cleared Dohos's diligence process for public listing as a subprocessor, not a statement that no infrastructure is used.

Separately, and on a different claim entirely, the infrastructure a restaurant's own reviewer would reasonably ask about is named directly: database, authentication, and backend hosting are disclosed as infrastructure. Being named as infrastructure is not the same thing as being an approved subprocessor — that status requires its own completed review, and no vendor, including the infrastructure named there, has cleared it yet. See subprocessors for the full distinction and how a vendor would earn a row.

04Legal library

The contracts and public notices behind the trust pages above — the versions a restaurant would actually sign or a caller would actually be shown, once any of this is approved and effective.

05Requesting more

A document this packet doesn't yet publish — a specific evidence request, a diligence questionnaire, or a follow-up on anything above — can be sent to /contact/security. That is the current intake for this packet; it is not a staffed, dedicated compliance desk, the same honest limit stated throughout this trust center.