Sub-Processors

Last Updated: May 20, 2026

1.Introduction

TrackLoop uses carefully selected third-party service providers (“sub-processors”) to help deliver our services. Each sub-processor is bound by data processing agreements and meets our security standards. This page provides transparency into who processes your data and how it is protected.

2.Infrastructure

Vercel

DPA Active

Hosting & edge delivery

Data Processed:: Application data, server logs, IP addresses
Location:: USA (global CDN)
Certifications:: SOC 2 Type II

Supabase

DPA Active

Database & authentication

Data Processed:: All tenant data, authentication tokens, user profiles
Location:: Canada (ca-central-1)
Certifications:: SOC 2 Type II

3.Payments

Stripe

DPA Active

Billing & payment processing

Data Processed:: Billing contact information, payment metadata. Full card numbers are tokenized by Stripe and never stored by TrackLoop.
Location:: USA, Canada, and Ireland depending on customer geography
Certifications:: PCI DSS Level 1, SOC 2 Type II

4.Communications

Resend

DPA Active

Transactional email delivery

Data Processed:: Email addresses, email content
Location:: USA
Certifications:: —

5.Monitoring

Sentry

DPA Active

Error monitoring & performance

Data Processed:: Error traces, anonymized application context
Location:: USA
Certifications:: SOC 2 Type II

Inngest

DPA Active

Background job processing

Data Processed:: Job payloads (order and customer data)
Location:: USA
Certifications:: —

6.AI Services

Anthropic (Claude)

DPA Active

AI-powered business intelligence and document drafting

Data Processed:: Order summaries, customer prompts, and document drafts submitted to AI features. Anthropic does not train on API customer data.
Location:: USA
Certifications:: SOC 2 Type II

7.Integrations & Infrastructure

Railway

DPA Active

PDF generation service (estimates, invoices, work orders)

Data Processed:: Document content sent for rendering (customer name, line items, totals). Content is processed in-memory and not persisted by Railway.
Location:: USA
Certifications:: —

Intuit QuickBooks

DPA Active

Accounting integration (only when enabled by tenant)

Data Processed:: Invoices, estimates, customer records, and payment records pushed at tenant's explicit configuration.
Location:: USA
Certifications:: SOC 2 Type II

Google Maps Platform

DPA Active

Address autocomplete and geocoding

Data Processed:: Address queries entered into TrackLoop forms (customer addresses, job sites).
Location:: Global
Certifications:: ISO 27001, SOC 2 Type II, SOC 3

Apple Push Notification Service

Standard Terms

Push notifications to TrackLoop iOS app

Data Processed:: Device tokens and notification payloads (no personal data in payloads beyond notification title and body).
Location:: USA
Certifications:: ISO 27001, SOC 2 Type II

8.Changes to Sub-Processors

We are committed to transparency regarding any changes to our sub-processor list. The following process applies when we add or replace a sub-processor:

1.30-Day Advance Notice: We will provide at least 30 days' advance written notice before adding any new sub-processor to this list.
2.Email Notification: All affected tenants will receive email notification detailing the new sub-processor, the data it will process, and the reason for the change.
3.Right to Object: Tenants may object to the addition of a new sub-processor within 30 days of receiving notification. If we are unable to resolve the concerns, the tenant may terminate their agreement in accordance with the terms of service.

9.Contact

For questions about our sub-processors or data processing practices, please contact our Privacy Officer:

Privacy Officer:: Maninderpal Saini, c/o Virtuallife Technologies Inc.
Email:: support@trackloop.ca
Mailing Address:: Unit 199, 7184 120 St, Surrey, BC V3W 0M6, Canada

Related Policies:

2.Infrastructure

Vercel

DPA Active

Hosting & edge delivery

Data Processed:: Application data, server logs, IP addresses
Location:: USA (global CDN)
Certifications:: SOC 2 Type II

Supabase

DPA Active

Database & authentication

Data Processed:: All tenant data, authentication tokens, user profiles
Location:: Canada (ca-central-1)
Certifications:: SOC 2 Type II

3.Payments

Stripe

DPA Active

Billing & payment processing

Data Processed:: Billing contact information, payment metadata. Full card numbers are tokenized by Stripe and never stored by TrackLoop.
Location:: USA, Canada, and Ireland depending on customer geography
Certifications:: PCI DSS Level 1, SOC 2 Type II

5.Monitoring

Sentry

DPA Active

Error monitoring & performance

Data Processed:: Error traces, anonymized application context
Location:: USA
Certifications:: SOC 2 Type II

Inngest

DPA Active

Background job processing

Data Processed:: Job payloads (order and customer data)
Location:: USA
Certifications:: —

7.Integrations & Infrastructure

Railway

DPA Active

PDF generation service (estimates, invoices, work orders)

Data Processed:: Document content sent for rendering (customer name, line items, totals). Content is processed in-memory and not persisted by Railway.
Location:: USA
Certifications:: —

Intuit QuickBooks

DPA Active

Accounting integration (only when enabled by tenant)

Data Processed:: Invoices, estimates, customer records, and payment records pushed at tenant's explicit configuration.
Location:: USA
Certifications:: SOC 2 Type II

Google Maps Platform

DPA Active

Address autocomplete and geocoding

Data Processed:: Address queries entered into TrackLoop forms (customer addresses, job sites).
Location:: Global
Certifications:: ISO 27001, SOC 2 Type II, SOC 3

Apple Push Notification Service

Standard Terms

Push notifications to TrackLoop iOS app

Data Processed:: Device tokens and notification payloads (no personal data in payloads beyond notification title and body).
Location:: USA
Certifications:: ISO 27001, SOC 2 Type II

8.Changes to Sub-Processors

We are committed to transparency regarding any changes to our sub-processor list. The following process applies when we add or replace a sub-processor:

1.30-Day Advance Notice: We will provide at least 30 days' advance written notice before adding any new sub-processor to this list.
2.Email Notification: All affected tenants will receive email notification detailing the new sub-processor, the data it will process, and the reason for the change.
3.Right to Object: Tenants may object to the addition of a new sub-processor within 30 days of receiving notification. If we are unable to resolve the concerns, the tenant may terminate their agreement in accordance with the terms of service.

9.Contact

For questions about our sub-processors or data processing practices, please contact our Privacy Officer:

Privacy Officer:: Maninderpal Saini, c/o Virtuallife Technologies Inc.
Email:: support@trackloop.ca
Mailing Address:: Unit 199, 7184 120 St, Surrey, BC V3W 0M6, Canada

Related Policies: