Cable, fiber, spectrum, satellite, routing equipment, and the data centers that hold everything else. Above the physical sits the logical: the name system that turns an address into a destination, the routing protocol that decides the path, and the certificate authorities on which every secure connection rests. A hijacked route or a fraudulently issued certificate places a party in the path that the application above has no way to detect. The padlock still appears.

The embedded software that controls how hardware behaves, sitting beneath the operating system in network equipment, servers, end-user machines, and industrial hardware. It is written by manufacturers, seldom subjected to the review applied to application code, and updated through channels most organizations do not watch. It also survives almost everything done to the layers above it.

The machine a person is actually looking at, the servers behind every provider in the chain, the appliances in between, and the expanding set of industrial, building, medical, and utility systems that now present browser-based operator interfaces. Those interfaces are assembled from the same supply chain as any other web application, and the decisions taken from what they display have physical consequences.

The commercial APIs and development kits organizations integrate rather than build. An SDK is not a passive data connection; it is executable code running with the permissions of the application hosting it. The organization reviewed version one at integration. The provider is shipping version fourteen, with materially broader capabilities, to everyone who ever integrated any version.

First-party code, and the substantially larger body of third-party code brought in from outside. Some of it is compiled into the application and fixed at the version chosen. Much of it is not: it is held by other parties and loaded from their systems when the application runs, which is why a bill of materials, being a record of what was assembled, does not describe it.

Applications do not only load code. They load configuration, feature flags, content feeds, localization strings, API responses, and increasingly the outputs of models hosted by third parties. Each is a supply chain input the application processes and, in most cases, puts on screen. It is also the least documented layer in the stack: there is rarely any record of which endpoints an application consults, still less of who holds them, and model providers have arrived as a class of sub-processor faster than disclosure practice has adjusted to them.

Images, fonts, stylesheets, video, audio, and documents. Not executable, and not passive either: a stylesheet decides what is visible and what is obscured, a font decides which characters are drawn, an image carries information straight into a person's judgment, and a document served through an application is read as the original because nothing on the page suggests otherwise.

Every layer below converges here, into the single picture a person reads and acts on. It is the only place the assembled chain is visible as a whole, and it is the place no framework in common use looks at. Each was built to confirm that individual components function as specified, and an assembly is not a component.

What the application actually did: the requests it made, the code it executed, the payloads it sent, the storage it wrote. Primary evidence for the code, data, resource, and service layers, and the only source that reflects the assembly rather than its parts.

Domain registration, address allocation, routing announcements, certificate transparency, and hosting records. These turn an observed host into a named operator, and they are how the network layer becomes something a person can reason about.

Sub-processor lists, data-processing agreements, audit reports, bills of materials, and procurement records. Not the ground truth, but the claim under test. Where disclosure is mandated, an omission is itself reportable.

Registries, filings, funding records, sanctions and enforcement data. These carry an operator through to a company, its owners, and the jurisdiction whose law governs what it does with your data. Equity Chain Mapping takes it from there.