Legal

Subprocessors

The companies that help us run SecureCrews. Each one has a data processing agreement (DPA) in place and only sees the data it needs to do its job.

Last updated October 12, 2026 · 9 subprocessors

Stripe

DPA active

Subscription billing and payment processing

stripe.com

Data accessed

Billing name, email address, billing address, payment card details

Security and compliance

PCI DSS Level 1 certified. SOC 2 Type II. Card data never touches SecureCrews servers.

Location

United States

Telnyx

DPA active

SMS text message delivery

telnyx.com

Data accessed

Phone numbers and message content.

Security and compliance

Messages encrypted in transit. Every message notification Telnyx sends us is signed and verified.

Location

United States

Amazon Web Services (AWS)

DPA active

Server hosting, encryption key management (KMS), transactional email delivery (SES)

aws.amazon.com

Data accessed

All application data (encrypted at rest). KMS manages encryption keys but never sees plaintext data. SES sees email addresses and email content.

Security and compliance

SOC 2 Type II. ISO 27001. FedRAMP authorized. AES-256 encryption at rest.

Location

United States (us-east-2)

Cloudflare

DPA active

File storage (R2), CDN, DDoS protection, DNS, and download gatekeeper

cloudflare.com

Data accessed

All uploaded files (documents, photos), encrypted in transit and at rest. Website traffic metadata.

Security and compliance

SOC 2 Type II. ISO 27001. Zero-egress architecture. All files encrypted with AES-256.

Location

Global edge network (data stored in US)

Google Maps Platform

DPA active

Address geocoding, map display, and place search

cloud.google.com/maps-platform

Data accessed

Property addresses submitted for geocoding

Security and compliance

SOC 2 Type II. ISO 27001. Standard Google Cloud terms.

Location

United States

Anthropic (Claude AI)

DPA active

AI-assisted drafting of customer review responses, and parsing of insurance carrier response documents when a contractor turns it on

anthropic.com

Data accessed

For review drafts: the review text, the star rating and the job type. No names, contact information or addresses are sent. For carrier response parsing: nothing at all unless your contractor switches it on, and it is off by default. When it is on, the text of the carrier document is sent, with Social Security numbers, email addresses, phone numbers and street addresses removed first. Names or claim numbers printed in that document may remain.

Security and compliance

Anthropic retains API inputs and outputs for up to 30 days, then deletes them. They are not used to train models. SOC 2 Type II.

Location

United States

Sentry

DPA active

Error monitoring and crash reporting

sentry.io

Data accessed

Error stack traces, browser and device metadata. PII is scrubbed before transmission. No session replay is used.

Security and compliance

SOC 2 Type II. ISO 27001. Data scrubbing enabled.

Location

United States

Google Analytics

DPA activeConsent required

Website usage analytics (marketing site only)

marketingplatform.google.com/about/analytics

Data accessed

Anonymized usage data: pages viewed, approximate location, device and browser type. IP anonymization is enabled.

Security and compliance

SOC 2 Type II. ISO 27001. Loads only after the visitor consents via the cookie banner.

Location

United States

Canopy Connect

DPA activeEnterprise only

Insurance policy verification (Enterprise tier only)

canopyconnect.com

Data accessed

Homeowner name, address, and authorization to pull policy info from their carrier

Security and compliance

SOC 2 Type II. Data encrypted in transit and at rest.

Location

United States

How we handle subprocessor changes

When we add a new subprocessor or make a significant change to an existing one, we update this page and notify Enterprise customers by email at least 30 days in advance. If you have concerns about a subprocessor, contact us at [email protected].

For our full privacy practices, see the Privacy Notice.