What this page is
VouchSite uses a small number of third-party service providers to operate the Service. This page lists every provider that can access Customer Data, what it does, and what it can see. We remain responsible for their performance under our Terms of Service.
Current sub-processors
| Provider | What it does for VouchSite | Customer Data it can access | Location |
|---|---|---|---|
| Bubble Group, Inc. (bubble.io) | Hosts the web application and the primary database | Account and organization records, Authorized User names and email addresses, subcontractor and broker company names and contact details, project records, extracted policy values, status history, and the activity log | United States |
| Amazon Web Services, Inc. (Amazon S3) | Stores submitted certificate files | Certificate documents as uploaded, including any information visible on them | United States |
| OpenAI, L.L.C. | Reads submitted certificates to extract expiration dates and coverage limits | Certificate document content, sent for processing at the time of submission | United States |
| Twilio Inc. | Delivers text messages and receives replies | Subcontractor mobile numbers and the content of messages sent and received | United States |
| Stripe, Inc. | Processes subscription payments | Billing contact details and payment method. Stripe holds card data directly; VouchSite never receives, stores, or transmits it | United States |
| Google LLC (Google Workspace) | Operates our support mailbox and the certificate intake mailbox that brokers and subcontractors may email documents to | Anything you include when you contact support, and any certificate or correspondence sent to our intake address, including attachments | United States |
Infrastructure providers that do not access Customer Data
Listed for completeness because they appear in our stack.
| Provider | Role | Why it is not a sub-processor |
|---|---|---|
| Cloudflare, Inc. | DNS management and hosting for the public marketing site | The marketing site collects no Customer Data, and application traffic does not route through Cloudflare's proxy |
Notes on specific providers
OpenAI. Certificate content is sent to OpenAI's API for parsing. Under OpenAI's API data policy, data sent to the API is not used to train or improve OpenAI models unless the customer explicitly opts in, and VouchSite has not opted in. OpenAI retains abuse-monitoring logs for up to thirty days unless longer retention is required by law.
Amazon S3. Certificates are held in a private bucket with public access blocked. Uploads and reads use short-lived presigned URLs. No certificate is reachable by an unauthenticated public URL.
Google Workspace. Our intake mailbox receives certificates emailed to us by brokers and subcontractors. Once a certificate is processed, the authoritative copy is held in Amazon S3 and the mailbox copy is removed on a routine schedule.
Stripe. VouchSite never captures, stores, or transmits card data. We hold only Stripe customer and subscription identifiers.
Changes to this list
We will post an updated version of this page before a new sub-processor begins processing Customer Data, and will notify account owners by email at least thirty days in advance. If you object to a new sub-processor, your remedy is to cancel before it takes effect, and section 9 of the Terms of Service governs your data export.