Trust CenterSub-processors
Subprocessors
The 6 services AssetLab engages to deliver the platform, with the purpose, processing location, data accessed, and safeguards for each.
Scope
This is the published sub-processor list referenced by Section 8.7 of the Terms of Service, Section 5.1 of the Privacy Policy, and Annex 3 of the AssetLab Data Processing Agreement. Every sub-processor is bound by a written data processing agreement with obligations no less protective than those in our DPA, and AssetLab remains liable to customers for their acts and omissions.
This page summarises Sub-processor List version 1.9, effective 12 October 2026. The full list, with contract and certification detail, cross-border transfer safeguards and the version history, is published as a PDF.
Current subprocessors
Supabase, Inc.
Database hosting (PostgreSQL), object storage, Edge Functions
- Processing location
- Canada - AWS ca-central-1 (Montreal, QC) for the database, object storage, backups and Edge Functions. The Storage CDN is a global service. Supabase Realtime is not used.
- Data accessed
- All Customer Data (assets, work orders, vendors, custom fields, attachments, audit logs), plus a mirror of user identity (Clerk user ID, name, business email, role) used for application joins and audit logging.
- Safeguards
- DPA; SOC 2 Type II; hosted in Canada (ca-central-1); AES-256 at rest
Clerk, Inc.
Authoritative identity store, authentication, SSO/SAML, passkeys
- Processing location
- United States - hosted on Google Cloud Platform and Cloudflare
- Data accessed
- Full identity record: name, business email, passkey registrations, session metadata, SSO configuration. Customer users sign in by email one-time code, Microsoft OAuth, enterprise SSO or passkey; customer accounts have no passwords.
- Safeguards
- DPA; EU-U.S. Data Privacy Framework; SCCs; UK and Swiss addenda; SOC 2 Type II; TIA on file
Cloudflare, Inc.
Application delivery (single-page app via Workers and CDN), web application firewall, DNS, DDoS protection
- Processing location
- Global edge (US-headquartered)
- Data accessed
- Request and connection logs (IP address, timestamp, user agent, path); traffic inspected at the edge by the web application firewall and not stored; administrative logs for AssetLab personnel. For the optional AI assistant (MCP) integration, the AssetLab MCP server runs at the Cloudflare location nearest the caller, which may be outside Canada, and processes the records a request returns while it is in flight; integration credentials are held only in encrypted form. No asset records or documents are stored at Cloudflare.
- Safeguards
- DPA; Data Privacy Framework; SCCs; UK and Swiss addenda; ISO/IEC 27001; ISO/IEC 27701; PCI DSS Level 1; SOC 2 Type II; TIA on file
Resend (Plus Five Five, Inc.)
Outbound transactional email delivery (work order, work request, preventive maintenance, contract and vendor notifications); inbound receiving for the optional email-to-work-request channel
- Processing location
- United States
- Data accessed
- Outbound: recipient address, organization name, record title and a deep link. Work request message notifications also carry up to the first 600 characters of the message body; vendor and preventive-maintenance share emails carry the message composed by the sending user. In-application bug reports are delivered through Resend with the reporter's name and email address and any files the reporter attaches. Inbound (optional): sender address and display name, subject, full message body. Resend keeps received messages for the life of the account, with no automatic deletion, and deletes them on request.
- Safeguards
- DPA; EU-U.S. Data Privacy Framework and UK Extension; SCCs; UK and Swiss addenda; SOC 2 Type II (Resend Platform, Security criteria); inbound receiving confirmed by Resend in writing as within the DPA; TIA on file
Amazon Web Services, Inc.
Offsite encrypted backup of the database, storage buckets and identity export
- Processing location
- Canada - AWS ca-central-1 (Montreal, QC)
- Data accessed
- A complete copy of all Customer Data, held only as client-side encrypted archives. AssetLab encrypts every artefact before upload using a key pair whose private key AWS has never held; AWS stores ciphertext it has no means to decrypt.
- Safeguards
- DPA supplementing the AWS Customer Agreement; SCCs; regional no-transfer undertaking; object-lock immutability; SOC 2 Type II; TIA on file
Sentry (Functional Software, Inc.)
Application error monitoring and diagnostics
- Processing location
- United States and other countries
- Data accessed
- Exception messages (with email addresses and tokens redacted) and stack traces, tagged with an opaque tenant identifier, role, component and action. No user identifier, name or email address. IP, user-agent and URL capture, breadcrumbs and session replay are off. No Customer records.
- Safeguards
- DPA executed 6 August 2026; Data Privacy Framework; SCCs; UK and Swiss addenda; sensitive data contractually prohibited; SOC 2 Type II; TIA on file
Changes to this list
We give as much advance notice of a new sub-processor, or of a material change to an existing relationship, as our own sub-processors allow, and in any event notify customers within five business days of becoming aware of the change, with a thirty-day objection window on reasonable data-protection grounds. See Terms of Service section 8.7 and the Data Processing Agreement section 6.3.
Need the signed version?
The DPA carries the authorized sub-processor list as Annex 3. Request a copy for your procurement or compliance review.
