A subprocessor is a company Optracs uses that can access customer data. Our Data Processing Addendum commits us to keeping this list current, and to giving 30 days' notice before we add or replace one.
Always in use
| Vendor | What it does for us | What it can access |
|---|---|---|
| Supabase | Database and sign-in | Every record in every workspace, and every user's sign-in details. Not the files themselves: those are held by Cloudflare. |
| Cloudflare | File storage (Cloudflare R2), the network in front of the application, and the spam check on public forms | Every file a customer uploads, such as job photographs, signed contracts and inspection reports, encrypted at rest. The spam check also sees the IP address of a visitor who is shown it. |
| Vercel | Application hosting | Data passing through each request, and what appears in application logs. |
| Stripe | Subscription billing, and card payments a contractor's customer makes against an invoice | The workspace's billing email, plan and subscription. For an invoice payment, the amount and the invoice number; the payer enters their card on Stripe's own page. No card number ever reaches Optracs. |
Supabase holds the records and Cloudflare holds the files. Neither holds both.
In use when a workspace uses the feature
| Vendor | What it does for us | What it receives |
|---|---|---|
| Resend | Email delivery | Each recipient's email address and name, the message, and delivery and open events. |
| Twilio | Text messages | Each recipient's phone number and the message. |
| Address lookup | A property address, and the map coordinates found for it. |
Operational vendors (no customer data)
These companies receive nothing belonging to a customer. They are listed so the list is complete.
| Vendor | What it does for us | What it receives |
|---|---|---|
| Better Stack | Alerts to our own staff | A severity, a short alert name and an internal id. Never an email address, an IP address, a workspace name, or any detail of what happened. |
We also read the public status pages of our vendors, which are hosted by Atlassian Statuspage; nothing is sent in those requests. Roofr sends measurement reports into Optracs and receives nothing from us, so it is not a subprocessor.