Files
supabase/apps/www/components/SubprocessorUpdatesForm.tsx
Pamela Chia c4c58ef3e3 feat: remove pandadoc dpa request flow (#48525)
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the
Data Processing Addendum by reference, so customers no longer sign a
separate DPA. Legal confirmed the PandaDoc signing flow can go;
previously signed DPAs remain binding. This removes the frontend flow
only. I'll remove the platform endpoint (`POST
/platform/organizations/{slug}/documents/dpa`) separately once the
PandaDoc contract conversation wraps.

**Changed:**

- **Dashboard DPA card no longer requests PandaDoc documents**: the
Request DPA button and confirm modal are replaced with a View DPA link
to the canonical legal page, with evergreen copy explaining the DPA is
part of the Terms. Tracked via the same `document_view_button_clicked`
event the other document cards use.
- **Legacy `/legal/dpa` page retired**: the page told users to request a
signed DPA from the dashboard, which no longer exists. It now
permanently redirects to
`/legal/customer-resources/data-processing-addendum` (the follow-up
already flagged in #48483), and the footer link is removed. The
`dpa_pdf_opened` and `dpa_request_button_clicked` events are removed
with their last call sites. The latest privacy version links the
canonical page directly; archived v1/v2 keep their original `/legal/dpa`
link, served by the redirect.
- **Orphaned DPA PDFs removed**: the four dated `Supabase+DPA+*.pdf`
files under `/downloads/docs` had zero remaining references once the
signing flow is gone. No redirect: nothing links these URLs, so they
404.
- **Subscription tracking**: the subprocessor updates form now fires
`www_subprocessor_updates_subscribed` on successful submit, so we can
measure uptake of the notification list that replaces per-customer DPA
emails.

## To test

Verified on the Vercel previews (Playwright):

- [x] Studio: `/org/_/documents` shows the DPA card with the
incorporation copy and a working View DPA link (href = canonical page);
no Request DPA button, no PandaDoc mention; TIA/SOC2/ISO27001/HIPAA
cards unaffected
- [x] www: `/legal/dpa` permanently redirects to
`/legal/customer-resources/data-processing-addendum`; footer no longer
shows DPA; zero console errors
- [x] www: subscribing on the subprocessor page succeeds (200 from the
form route, profile created with topic_4) and fires
`www_subprocessor_updates_subscribed` (201 from the telemetry endpoint);
test profile unsubscribed afterwards
- [x] www: `/downloads/docs/Supabase+DPA+260601.pdf` returns 404 with no
redirect; DPA card copy verified without the effective date

## Linear

- fixes GROWTH-1068
2026-07-31 16:18:25 +08:00

130 lines
4.4 KiB
TypeScript

import { useSendTelemetryEvent } from '~/lib/telemetry'
import Link from 'next/link'
import { useState } from 'react'
import { Button, Input, Label } from 'ui'
const isValidEmail = (email: string): boolean => {
const emailPattern = /^[\w-\.+]+@([\w-]+\.)+[\w-]{2,8}$/
return emailPattern.test(email)
}
/**
* Subscribe form for subprocessor update notifications.
* Mirrors components/SecurityNewsletterForm.tsx, posting to the
* /api-v2/submit-form-subprocessor-updates route (Customer.io "Subprocessor Alerts", topic_4).
*/
const SubprocessorUpdatesForm = () => {
const [firstName, setFirstName] = useState('')
const [lastName, setLastName] = useState('')
const [email, setEmail] = useState('')
const [status, setStatus] = useState<'idle' | 'loading' | 'success' | 'error'>('idle')
const [errorMessage, setErrorMessage] = useState('')
const sendTelemetryEvent = useSendTelemetryEvent()
const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault()
setErrorMessage('')
if (!firstName || !lastName || !email) {
setErrorMessage('All fields are required.')
return
}
if (!isValidEmail(email)) {
setErrorMessage('Please enter a valid email address.')
return
}
setStatus('loading')
try {
const res = await fetch('/api-v2/submit-form-subprocessor-updates', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ firstName, lastName, email }),
})
if (!res.ok) {
const data = await res.json()
throw new Error(data.message || 'Something went wrong')
}
setStatus('success')
sendTelemetryEvent({ action: 'www_subprocessor_updates_subscribed' })
} catch (err: any) {
setStatus('error')
setErrorMessage(err.message || 'Something went wrong. Please try again.')
}
}
return (
<div className="border rounded-xl bg-surface-75 p-4 md:p-6 w-full max-w-lg not-prose">
<p className="text-foreground-light text-sm text-pretty mb-6">
<strong className="text-foreground">Subscribe to updates</strong>. Receive an email
notification when Supabase updates its sub-processors. By submitting this form, you
acknowledge and agree that Supabase will process your personal information in accordance
with our{' '}
<Link
href="https://supabase.com/privacy"
className="text-brand-link hover:underline"
target="_blank"
rel="noopener noreferrer"
>
Privacy Policy
</Link>
.
</p>
{status === 'success' ? (
<p className="text-foreground text-sm">
Thanks for subscribing! You'll receive an email when Supabase updates its sub-processors.
</p>
) : (
<form onSubmit={handleSubmit} className="flex flex-col gap-4">
<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-first-name">First name</Label>
<Input
id="subprocessor-first-name"
type="text"
value={firstName}
onChange={(e) => setFirstName(e.target.value)}
placeholder="First name"
required
/>
</div>
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-last-name">Last name</Label>
<Input
id="subprocessor-last-name"
type="text"
value={lastName}
onChange={(e) => setLastName(e.target.value)}
placeholder="Last name"
required
/>
</div>
</div>
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-email">Email</Label>
<Input
id="subprocessor-email"
type="email"
value={email}
onChange={(e) => setEmail(e.target.value)}
placeholder="Email"
required
/>
</div>
{errorMessage && <p className="text-destructive text-sm">{errorMessage}</p>}
<Button variant="primary" size="large" type="submit" loading={status === 'loading'}>
Subscribe
</Button>
</form>
)}
</div>
)
}
export default SubprocessorUpdatesForm