This page is an unexecuted working draft written to describe how NexusFFL actually handles data today. It has not been reviewed or approved by an attorney, it has not been adopted by [LEGAL ENTITY NAME], and it creates no rights or obligations for anyone. Do not rely on it. Bracketed blanks marked like [THIS] are unresolved and must be completed before this document is published.
Every third party that can touch customer data, what it receives, and whether it is on by default. Firearm purchaser data reaches exactly one vendor unless a dealer connects another.
This page lists every third party that may process customer data on NexusFFL’s behalf, what each one receives, and whether it is active for every customer or only when a dealer switches it on. It is referenced by our Data Processing Addendum section 9. The deliberately short list is the point: firearm purchaser data touches exactly one vendor unless a dealer chooses otherwise.
These process customer data for every NexusFFL customer.
| Subprocessor | Purpose | Data it processes | Location | Status |
|---|---|---|---|---|
| Railway Corp. [CONFIRM LEGAL ENTITY NAME AND REGISTERED ADDRESS — a dealer needs both to file the ATF host-facility notice] |
Application hosting, compute, persistent storage of the database and uploaded files, TLS termination, platform logging. | All customer data, including electronic and scanned ATF Forms 4473, A&D records, attachments, account records and audit logs. | United States — US East (iad) region; volume mounted at /data. |
Active for all |
| Resend | Transactional email: password reset links, two-factor recovery notices, and security alerts (e.g. a recovery code being used, a password being changed). | Recipient email address, display name, and the content of the message. Not Form 4473 or A&D data. | United States | Active for all |
| Plausible Analytics | Cookieless website analytics on the public marketing pages | Aggregate page views and referrers. No personal data, no cookies, no buyer or dealer records. | EU (Germany) | Always on (marketing pages only — not the application) |
ATF host-facility notice. ATF Rulings 2016-1 and 2016-2 require a licensee to notify its ATF Industry Operations area office of the name and address of the facility hosting its records, within 30 days of contracting for or changing that host. Because NexusFFL runs on Railway, Railway is the host facility you must name. NexusFFL provides a screen to record and produce that notice, but sending it is yours to do. We will notify customers in advance if the host ever changes, so the 30-day clock can be met.
None of the following receive anything unless the dealer connects their own account with that provider from Settings → Integrations. When connected, the dealer is also contracting directly with that provider under its own terms.
| Subprocessor | Purpose | Data it processes | Location | Status |
|---|---|---|---|---|
| NMI (Network Merchants LLC) via the dealer’s own gateway account with a firearms-friendly ISO |
Card payment authorization and refunds at point of sale. The primary payment path, chosen because firearms-friendly processors ride NMI’s gateway rails. | Transaction amount and card payment details submitted at checkout. No Form 4473 data, no A&D record, no buyer identity from the 4473. | United States | Opt-in |
| Stripe, Inc. | Card payment authorization and refunds — a secondary, opt-in alternative for dealers who have separately obtained Stripe’s restricted approval for firearms sales. | Transaction amount and payment method identifier. No Form 4473 data, no A&D record. | United States | Opt-in |
| Intuit Inc. (QuickBooks Online) | Nightly one-way accounting sync: each completed sale is posted as a summary sales receipt. | Sale totals, tax totals, item count and the NexusFFL transaction reference. The customer is always posted as a generic “Walk-in customer” — no buyer name, no firearm serial number, no 4473 data is sent. | United States | Opt-in |
| Xero Limited | Nightly one-way accounting sync: each completed sale is posted as a summary invoice. | Sale totals, tax totals and the NexusFFL transaction reference, plus the customer name typed on the point-of-sale transaction, if the dealer entered one (otherwise “Walk-in customer”), used as the invoice contact. No firearm serial number and no 4473 data is sent. | New Zealand / United States [CONFIRM XERO’S PROCESSING LOCATIONS AND WHETHER ANY NON-U.S. PROCESSING OCCURS — this bears on the DPA’s U.S.-only commitment] | Opt-in |
Listed in advance so the change is not a surprise. Neither is live today; this page and any required notice will be updated before either begins processing customer data.
| Subprocessor | Purpose | Data it will process | Status |
|---|---|---|---|
| [S3-COMPATIBLE OBJECT STORAGE PROVIDER AND REGION — NOT YET SELECTED] | Off-site storage of nightly backup archives, so backups do not sit only on the same volume as the data they protect. | Encrypted backup archives containing all customer data. Archives are AES-256 encrypted before they leave the server, so the provider holds ciphertext only. The region must be in the United States to stay consistent with ATF Ruling 2016-1. | Planned |
| [SUBSCRIPTION BILLING PROVIDER — NOT YET SELECTED] | Collecting subscription fees from dealers. NexusFFL does not currently charge cards for subscriptions. | Dealer business and billing contact details. Not customer or 4473 data. | Planned |
Before adding or replacing a subprocessor that processes customer data, [LEGAL ENTITY NAME] will give account owners [ADVANCE NOTICE PERIOD, e.g. 30 days] notice by [NOTICE MECHANISM] and update this page. Dealers can object on reasonable data-protection grounds as described in DPA section 9. To be added to the notification list, contact [SECURITY CONTACT EMAIL].