Subprocessors

The third-party services that process customer data

The 6 services AssetLab engages to deliver the platform, with the purpose, processing location, data accessed, and safeguards for each.

All legal documents

← All documents

Version: 1.4
Last updated: September 2, 2026

Scope

This is the published sub-processor list referenced by Section 8.7 of the Terms of Service, Section 5.1 of the Privacy Policy, and Annex 3 of the AssetLab Data Processing Agreement. Every sub-processor is bound by a written data processing agreement with obligations no less protective than those in our DPA, and AssetLab remains liable to customers for their acts and omissions.

Current subprocessors

Supabase, Inc.

Database hosting (PostgreSQL), object storage, Edge Functions, Realtime change streaming

Processing location: Canada - AWS ca-central-1 (Montreal, QC) for the database, object storage and backups. Supabase Realtime, Edge Functions and the Storage CDN are global services with no in-region configuration; for a ca-central-1 project the Realtime cluster is mapped to us-east-1 (United States).
Data accessed: All Customer Data (assets, work orders, vendors, custom fields, attachments, audit logs), plus a mirror of user identity (Clerk user ID, name, business email, role) used for application joins and audit logging. Supabase Realtime decodes changed rows from the write-ahead log and applies the per-subscriber row-level security filter in the cluster region, which for a ca-central-1 project is the United States. Realtime retains nothing at rest.
Safeguards: DPA; SOC 2 Type II; Canadian data residency; AES-256 at rest

Clerk, Inc.

Authoritative identity store, authentication, MFA, passkeys, SSO/SAML, SCIM

Processing location: United States
Data accessed: Full identity record: name, business email, MFA factors, session metadata, SSO configuration. No passwords: sign-in is by email one-time code, Microsoft OAuth or enterprise SSO only, so no password hashes are held for AssetLab users.
Safeguards: DPA; EU-U.S. Data Privacy Framework; SCCs; UK and Swiss addenda; SOC 2 Type II; TIA on file

Cloudflare, Inc.

Application delivery, web application firewall, DNS, DDoS protection

Processing location: Global edge (US-headquartered)
Data accessed: Request and connection logs (IP address, timestamp, user agent, path); transit traffic decrypted at the edge for firewall inspection and not stored; administrative logs for AssetLab personnel; integration client registrations persisted in a globally replicated key-value store. No asset records, documents or credentials.
Safeguards: DPA; Data Privacy Framework; SCCs; UK and Swiss addenda; ISO/IEC 27001; ISO/IEC 27701; PCI DSS Level 1; SOC 2 Type II; TIA on file

Resend (Plus Five Five, Inc.)

Outbound transactional email delivery (work order, work request, preventive maintenance, contract and vendor notifications); inbound receiving for the optional email-to-work-request channel

Processing location: United States
Data accessed: Outbound: recipient address, organization name, record title and a deep link. Work request message notifications also carry up to the first 600 characters of the message body; vendor and preventive-maintenance share emails carry the message composed by the sending user. In-application bug reports are delivered through Resend with the reporter's name and email address and any files the reporter attaches. Inbound (optional): sender address and display name, subject, full message body.
Safeguards: DPA; EU-U.S. Data Privacy Framework and UK Extension; SCCs; UK and Swiss addenda; SOC 2 Type II (Resend Platform, Security criteria); TIA on file

Amazon Web Services, Inc.

Offsite encrypted backup of the database, storage buckets and identity export

Processing location: Canada - AWS ca-central-1 (Montreal, QC)
Data accessed: A complete copy of all Customer Data, held only as client-side encrypted archives. AWS stores ciphertext it has no means to decrypt.
Safeguards: DPA supplementing the AWS Customer Agreement; SCCs; regional no-transfer undertaking; object-lock immutability; SOC 2 Type II; TIA on file

Sentry (Functional Software, Inc.)

Application error monitoring and diagnostics

Processing location: United States and other countries
Data accessed: Opaque user and tenant identifiers, role, component and action tags, exception messages and stack traces. IP, user-agent and URL capture disabled; session replay off. No Customer records.
Safeguards: DPA executed 6 August 2026; Data Privacy Framework; SCCs; UK and Swiss addenda; sensitive data contractually prohibited; SOC 2 Type II; TIA on file

Changes to this list

We give as much advance notice of a new sub-processor, or of a material change to an existing relationship, as our own sub-processors allow, and in any event notify customers within five business days of becoming aware of the change, with a thirty-day objection window on reasonable data-protection grounds. See Terms of Service section 8.7 and the Data Processing Agreement section 6.3.