Trust & legal
Subprocessors
Last updated 2026-10-16
Current subprocessors
(Third-party subcontractors that process customer data.)
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | DNS, TLS, firewall and DDoS protection in front of every request | All web traffic passes through it (encrypted in transit) | Global network |
| Application hosting — a US-based cloud server provider (virtual private servers) | Hosts the application and database | All Customer data | United States |
| Amazon Web Services (S3) | Photo and file storage; nightly database backups | Photos and files; encrypted database backups | United States (US West, Oregon) |
| Resend | Transactional email (updates to residents, staff notices, reports) | Recipient email address and message content | United States |
| Anthropic (Claude) | AI: request type suggestions, resident chat, chat insights, Spanish translation drafts, staff help assistant | Only the text or photo each feature needs | United States |
| Mapbox | Base maps and street routing | Map tile requests; stop coordinates for routing (no names or contact details) | United States |
| OpenStreetMap Foundation (Nominatim) | Address search and reverse geocoding when the city has no address layer | Search text and coordinates | United Kingdom / EU |
| Clerk | Staff sign-in and single sign-on (when enabled) | Staff name and email | United States |
City-provided services
A city’s own Esri ArcGIS services (districts, address points, parcels) are queried directly on the city’s behalf; those services are operated by the city, not by CSP.
Fallbacks
If Mapbox is unavailable, routing may fall back to an OSRM routing server and straight-line estimates. Production deployments use a self-hosted or Mapbox service, not the public OSRM demo server.
Changes
We update this page when subprocessors change. Customers with a signed DPA are notified in advance. Questions: [email protected].