Subprocessors
Last updated: August 6, 2026
A subprocessor is a third party that processes customer data on our behalf. This page lists every one we use. We keep the list short on purpose, and we publish it so you can check it rather than take our word for it.
Current subprocessors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing and subscription billing | Billing contact email address, organization identifier, subscription and payment records | United States |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery | Recipient email address and the content of the message sent — account verification links, password resets, compliance reminders and account notices | United States |
| Google LLC | Website analytics and advertising measurement, on our public pages only | IP address and the address of the public page viewed | United States |
What is deliberately not on this list
Hosting, the database and evidence storage are ours. The application, the database that holds your workspace, and the write-once store holding your evidence files all run on hardware we own and operate in the United States. There is no cloud hosting provider, no managed database service and no third-party object store in this product, so none of them appear above.
Your evidence files never leave our infrastructure. No subprocessor listed above receives evidence documents, control narratives, risk entries, audit records or any other content from inside your workspace.
Card numbers never reach us. Payment details are entered directly into Stripe’s hosted checkout. We never see or store them.
Google only runs after you accept. The analytics tag is not loaded at all unless a visitor accepts cookies. It runs on our public pages and on the billing page only — never on the pages holding your records — so no address containing a record identifier is sent to Google. See the Privacy Policy.
Changes
We will update this page before a new subprocessor begins processing customer data. If you would like advance notice by email, or you object to a proposed subprocessor, contact us through the contact form and we will add you to the notification list.