Subprocessor inventory
DRAFT · 2026-10-20-draft · Incomplete inventory. No production recipient approvals established.
The operator must fill this schedule from the actual deployment and executed provider contracts. Source code and prior trust-page copy mention the following integrations; they do not verify active accounts, legal entity names, processing locations or contractual safeguards.
| Service category | Code or configuration candidate | Data potentially involved | Required verification |
|---|---|---|---|
| Application/database/file hosting | Operator-managed Frappe, MariaDB and file storage | Configured application records and attachments | Infrastructure operator/entity, physical region, access controls, contract and backup location. |
| Network delivery | Cloudflare Tunnel referenced in deployment/trust materials | Requests, network metadata and traffic subject to deployment settings | Actual account, service configuration, entity, locations, retention and contract. |
| Text messaging | Twilio integration | Phone numbers and message content | Enabled status, account owner, sending permissions, recipient entity, locations and terms. |
| Payment processing | Stripe, Inc. through Stripe Connect, when payments are switched on for a company (vozanto/payments.py); each moving company has its own connected account, and development uses Stripe's sandbox |
The amount, the job or bill it is for and the payer's email; the moving company's owners, business and bank details, which Stripe collects in its own setup. Card and bank numbers are typed into Stripe's own forms; Vozanto never receives them | The live account's legal entity, the Connect platform agreement accepted, processing location, and Stripe's own subprocessor list. The moving company's own agreement with Stripe is the Stripe Connected Account Agreement (see the terms). |
| Email delivery | Postmark, a service of ActiveCampaign, LLC, in production only (vozanto/postmark.py, docs/postmark.md); development uses Mailpit |
Recipient addresses, message content and attachments, and bounce and spam-complaint records; Postmark's default keeps message content and metadata 45 days | Account owner, the Postmark terms and DPA version accepted, processing location (Postmark's privacy page names the United States: ServerCentral near Chicago, and AWS), the retention setting chosen, and Postmark's own subprocessor list. Mailpit is not evidence of a production mail service. |
| A company's own mailbox | Google (Gmail API) or Microsoft (Graph), only when a company connects its Gmail or Outlook (docs/google.md, docs/microsoft.md) |
The messages sent from that mailbox, and customers' replies read onto jobs | Whether counsel treats these as customer-selected independent services rather than subprocessors, and the notice the privacy policy gives. |
| Optional social login | Google, Microsoft, Apple | Provider identity claims and authentication exchange | Enabled providers, actual configuration, legal roles and separate notices. These are not automatically customer-appointed processors. |
| Booking/calendar | Cal.diy integration | Booking and scheduling information | Hosting/operator, enabled data exchange, location and contract. |
| Maps and geocoding | Configured map/geocoding services | Addresses and location requests | Trace actual requests, recipients, locations and terms. |
| Monitoring, backup and support | Deployment-dependent; not verified | Logs, backups and support material | List tools, operators, entities, locations, access and retention. |
| Backup storage | Backblaze B2, a private bucket in US East with server-side encryption by Backblaze (deploy/cloud-backup.sh, deploy/CLOUD.md) |
Daily copies of the database and files, and the site configuration without its encryption key; kept 30 days | Account owner, legal entity, the Backblaze terms and DPA version accepted, the 30-day lifecycle rule as set on the bucket, and Backblaze's own subprocessor list. |
For each active recipient, replace candidate information with: exact legal entity, purpose, data categories, processing country/region, approved contract or DPA reference, international-transfer safeguard where applicable, customer notice/authorization date and inventory version. Mark disabled integrations explicitly and verify they do not send data. Distinguish subprocessors from customer-selected independent services with counsel.
Before a recipient changes, use the notice and objection process approved in the executed DPA. The operator must determine a notice period and escalation contact before publication. Archive previous schedules and document when each change took effect.