A subprocessor is a company Optracs uses that can access customer data. Our Data Processing Addendum commits us to keeping this list current, and to giving 30 days' notice before we add or replace one.
Always in use
| Vendor | What it does for us | What it can access |
|---|---|---|
| Supabase | Database and sign-in | Every record in every workspace, and every user's sign-in details. Not the files themselves: those are held by Cloudflare. |
| Cloudflare | File storage (Cloudflare R2), the network in front of the application, and the spam check on public forms | Every file a customer uploads, such as job photographs, signed contracts and inspection reports, encrypted at rest. The spam check also sees the IP address of a visitor who is shown it. |
| Vercel | Application hosting | Data passing through each request, and what appears in application logs. |
| Stripe | Subscription billing, and card payments a contractor's customer makes against an invoice | The workspace's billing email, plan and subscription. For an invoice payment, the amount and the invoice number; the payer enters their card on Stripe's own page. No card number ever reaches Optracs. |
| PostHog | Counting how Optracs is used, and screen recordings of the demo's sample company, of this website and of the sign-up page | For each count, a workspace id and a random account id (never a name or email address), the kind of screen, and the browser and device. On this website and the demo, only for a visitor who accepted analytics: a random visitor id, the pages and buttons used, and recordings with anything typed into a form hidden. For a visitor who rejected, only that a page was opened, with no id. The signed-in application is never recorded. Held in the United States. |
Supabase holds the records and Cloudflare holds the files. Neither holds both.
Email you send to an Optracs address, such as info@optracs.com, is held in our company mailbox, which Google provides (Google Workspace). If you sign in to Optracs with your Google account, Google receives nothing from your workspace.
In use when a workspace uses the feature
| Vendor | What it does for us | What it receives |
|---|---|---|
| Resend | Email delivery | Each recipient's email address and name, the message, and delivery and open events. |
| Twilio | Text messages | Each recipient's phone number and the message. |
The Optracs iPhone app asks Apple's maps service to find a job's address, so that it can draw a map. Apple receives that address from the phone, and nothing else from your workspace, and handles it under its own terms.
Operational vendors (no customer data)
These companies receive nothing belonging to a customer. They are listed so the list is complete.
| Vendor | What it does for us | What it receives |
|---|---|---|
| Better Stack | Alerts to our own staff | A severity, a short alert name and an internal id. No personal data. |
We also read the public status pages of our vendors; nothing is sent in those requests.