What this page is
VouchSite uses a small number of third-party service providers to operate the Service. This page lists every provider that can access Customer Data, what it does, and what it can see. We remain responsible for their performance under our Terms of Service.
Current sub-processors
| Provider | What it does for VouchSite | Customer Data it can access | Location |
|---|---|---|---|
| Bubble Group, Inc. (bubble.io) | Hosts the web application and the primary database | Account and organization records, Authorized User names and email addresses, subcontractor and broker company names and contact details, project records, extracted policy values, status history, and the activity log | United States |
| Amazon Web Services, Inc. (Amazon S3) | Stores submitted certificate files | Certificate documents as uploaded, including any information visible on them | United States |
| OpenAI, L.L.C. | Reads submitted certificates to extract expiration dates and coverage limits | Certificate document content, sent for processing at the time of submission | United States |
| Twilio Inc. | Delivers text messages and receives replies | Subcontractor mobile numbers and the content of messages sent and received | United States |
| Stripe, Inc. | Processes subscription payments | Billing contact details and payment method. Stripe holds card data directly; VouchSite never receives, stores, or transmits it | United States |
| Google LLC (Google Workspace) | Operates our support mailbox and the certificate intake mailbox that brokers and subcontractors may email documents to | Anything you include when you contact support, and any certificate or correspondence sent to our intake address, including attachments | United States |
| Celonis, Inc. (Make — make.com) | Runs the automation that moves a certificate emailed to our intake address into storage: it reads the message, takes the attachment, and hands it to the same upload endpoints the web application uses | The intake message and its attachments — sender address, subject, message headers, and the certificate document itself — together with the request token identifying which subcontractor and project the certificate belongs to | United States |
| AC PM, LLC (Postmark — postmarkapp.com) | Delivers the email we send — certificate requests to insurance producers and subcontractors, reminders, and review notices | Recipient email addresses, the subject and full content of every message we send — which includes the subcontractor company name, the project name and the single-use link — and the delivery result for each message | United States |
Infrastructure providers that do not access Customer Data
Listed for completeness because they appear in our stack.
| Provider | Role | Why it is not a sub-processor |
|---|---|---|
| Cloudflare, Inc. | DNS management and hosting for the public marketing site | The marketing site collects no Customer Data, and application traffic does not route through Cloudflare's proxy |
Notes on specific providers
OpenAI. Certificate content is sent to OpenAI's API for parsing. Under OpenAI's API data policy, data sent to the API is not used to train or improve OpenAI models unless the customer explicitly opts in, and VouchSite has not opted in. OpenAI retains abuse-monitoring logs for up to thirty days unless longer retention is required by law.
Amazon S3. Certificates are held in a private bucket with public access blocked. Uploads and reads use short-lived presigned URLs. No certificate is reachable by an unauthenticated public URL.
Google Workspace. Our intake mailbox receives certificates emailed to us by brokers and subcontractors. Once a certificate is processed, the authoritative copy is held in Amazon S3 and the mailbox copy is moved to the mailbox trash immediately. Google permanently deletes trashed mail after thirty days; for a further twenty-five days an administrator can restore it.
Make (Celonis, Inc.). Our email intake automation runs on Make, operated by Celonis, Inc. A message is processed only long enough to move its attachment into Amazon S3 — Make is not a storage location for certificates. Under our data processing agreement, Celonis will securely destroy or return personal data in its possession within thirty days of our subscription ending, on request. Make publishes its own sub-processors at make.com/en/sub-processors.
Postmark (AC PM, LLC). Outbound email is sent through Postmark. A message is delivered and then held in Postmark's activity history, where we can see what was sent and whether it arrived; Postmark is not a storage location for certificates, and no certificate document is ever attached to a message we send. Postmark publishes its own sub-processors and data processing addendum at postmarkapp.com/dpa.
Stripe. VouchSite never captures, stores, or transmits card data. We hold only Stripe customer and subscription identifiers.
Changes to this list
We will post an updated version of this page before a new sub-processor begins processing Customer Data, and will notify account owners by email at least thirty days in advance. If you object to a new sub-processor, your remedy is to cancel before it takes effect, and section 9 of the Terms of Service governs your data export.