TerraVex Subprocessors
Last updated: October 7, 2026
This list is incorporated into the Data Processing Addendum (https://app.terravexos.com/legal/dpa) as Annex III and is the single source of truth for the vendors that process data for TerraVex. Each is bound by a written agreement that requires it to give personal data the same or equal protection as our Privacy Policy and the DPA, and to use it only to provide its service to TerraVex. To receive notice of changes by email, write to privacy@terravexos.com; Customers' admin addresses are emailed at least 30 days before a subprocessor is added or replaced, as described in Section 6.3 of the DPA.
Subprocessors we use
| Subprocessor | Purpose | Data processed | Region | Notes |
|---|---|---|---|---|
| Supabase | Application backend: database, authentication, serverless functions and file storage | All Customer Data at rest and in transit through the platform, including property plans, inspection photos, application records and uploaded documents | United States | Core hosting provider; data encrypted at rest and in transit; daily backups |
| Netlify | Web hosting and content delivery for app.terravexos.com and terravexos.com | Request metadata (IP address, user agent) in access logs; website contact-form submissions | United States | Serves the application; no Customer Data stored |
| Stripe | Subscription billing; payment processing and Stripe Connect payouts for Customers' invoices; platform fee collection | Payment and payout metadata; cardholder data handled directly by Stripe (PCI) | United States | Customer is merchant of record on its connected account |
| Twilio | Click-to-dial calling and SMS messages | Phone numbers, message/call metadata and content initiated by the Customer, and text consent status | United States | Optional; Customer-enabled. A Customer may instead connect its own Twilio account |
| Resend | Transactional and client email delivery, including sign-in codes, service records and invoices | Recipient email, subject, and message content | United States | |
| Sentry | Error and performance monitoring for the web app and backend functions | Error details, the page, recent actions before the error, device and browser type, and the signed-in user's ID, email, company ID and role; performance timings for about 5% of sessions | United States | Error reports kept up to 90 days |
| OpenAI | AI features: vision estimating from photos and video frames, walkthrough voice-note transcription, note polishing, and staff-only course drafting | Photos and video frames, walkthrough audio, notes and transcripts, and the generated outputs; sent only after the person gives permission in the app | United States | Terms prohibit training on inputs and outputs; inputs may be kept up to 30 days for abuse monitoring; see the AI Features Disclosure (https://app.terravexos.com/legal/ai) |
| Optional Sign in with Google; web fonts (Google Fonts); address geocoding (Google Maps Platform) | For sign-in, the user's Google account email and name; for fonts, the viewer's IP address and browser type; for geocoding, property addresses and derived coordinates | United States | ||
| OpenStreetMap Foundation | Geocoding (Nominatim) when Google geocoding is not configured or is unavailable; map images on the jobs map | Property address text (geocoding); the viewer's IP address, browser type and the map area shown (map images) | United Kingdom | Single low-volume queries with attribution, under OpenStreetMap's usage policies |
| Browser push services (Apple, Google, Mozilla) | Delivering push notifications to browsers that have turned them on | The browser's push address; notification content is encrypted end to end and unreadable to the push service | United States | Optional; user-enabled in the browser |
| Apple | Optional Sign in with Apple | The user's Apple account email (or relay address) and name | United States | Optional; user-chosen |
| RentCast | Property-data lookup for estimating | Property address and returned property attributes (for example square footage) | United States | Optional |
| Better Stack | Uptime monitoring and the public status page | None beyond the availability of public endpoints | United States |
Services used only if you connect them
These services hold their own accounts with the Customer. Data moves between TerraVex and the service only after the Customer connects it, and only at the Customer's direction.
| Service | Purpose | Data processed | Region | Notes |
|---|---|---|---|---|
| QuickBooks (Intuit) | Optional accounting synchronization | Invoice, customer and financial records the Customer chooses to sync | United States | Customer-connected |
| Checkr | Optional background checks and drug screening | Candidate name, email, phone and work location, sent when a Customer orders a screening, including from the new hire flow; consent and the report itself are handled on Checkr's own pages; TerraVex receives the report's status, Checkr's recommended outcome label and a link to the report | United States | Customer-connected to its own Checkr account |
| Fingercheck | Optional payroll and HR connection: adding new hires and sending hours | New hire name, email, phone, start date, job title, pay type and base pay rate, sent when the Customer adds a hire to Fingercheck; hours, overtime and time off per pay period, sent from the Timesheet; TerraVex keeps only the Fingercheck employee number. Tax and direct-deposit forms are completed on Fingercheck's own onboarding, not in TerraVex | United States | Customer-connected with keys from its own Fingercheck account |
| Gusto | Optional payroll connection: sending hours and reading pay rates | Team member names, hours, overtime, time off and pay rates | United States | Customer-connected to its own Gusto account |
Web addresses a Customer sets up to receive its own data through the Service's API keys or webhooks (for example an automation tool) are chosen and controlled by the Customer and are not TerraVex subprocessors.
Onward subprocessors used by the providers above are governed by their respective agreements.
Change log
- October 7, 2026: first published.