Tradeforce Pros — Subprocessors

DRAFT — PENDING ATTORNEY REVIEW. NOT LEGAL ADVICE. Drafted by an AI legal researcher (R-251 item 10, R-252 item 3). Every vendor below was verified in the codebase on 2026-10-17. Do not publish until the [FOUNDER TO CONFIRM] items are resolved from the vendors' dashboards.

Version: 0.2-draft · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-24

This page lists the third parties ("Subprocessors") that [Tradeforce Pros, LLC] uses to host, process or transmit Customer Data for our customers. It forms part of our Data Processing Addendum ("DPA"). Terms not defined here have the meanings in the Terms of Service.

1. Current Subprocessors

Subprocessor	Purpose	Data involved	Location
Neon, Inc.	Managed PostgreSQL database. Stores all application data, including the background-job queue	All Customer Data and User account data	United States, on AWS [FOUNDER TO CONFIRM region in the Neon console; test fixtures suggest us-east-1]
Vercel Inc.	Hosting of the web application; request handling and logs	All data in transit; request metadata including IP address and browser user agent	United States [FOUNDER TO CONFIRM function region]
Railway Corporation	Hosting of our background worker (email dispatch, document generation) and our self-hosted document-conversion service	Proposal content and email recipients while a job runs. The conversion service keeps no copies	United States [FOUNDER TO CONFIRM region; document conversion not yet deployed (CF-138)]
Amazon Web Services, Inc. (Amazon S3)	Private storage of generated proposal documents (Word and PDF), customer Word templates and logos	Contents of generated documents, which can include end-customer names, contacts, site addresses and prices	United States: us-east-1 (N. Virginia)
Stripe, Inc.	Subscription billing and payments	Billing contact name and email, company name, subscription and payment status. Card numbers go directly to Stripe and never reach us	United States
Resend [FOUNDER TO CONFIRM legal entity name from the Resend agreement]	Sending account and security emails (invitations, sign-up links, password resets, checkout links, security alerts)	Recipient name and email address; message content (one-time links; never passwords)	United States
Google LLC (Google Maps Platform, Places API)	Address suggestions as a user types an address. Requests come from our server, not your browser	The typed address text and the selected place's identifier. No user name, email, IP or cookie is sent	Global (Google infrastructure)
Functional Software, Inc. d/b/a Sentry	Error monitoring of our servers and background worker	Technical error data, scrubbed by an allow-list before sending (no request bodies, headers, cookies, emails, tokens or database values); may include a company identifier for a failed job	United States [FOUNDER TO CONFIRM US data region] · [Remove this row if monitoring is not switched on at launch]
Anthropic, PBC (Claude, an AI assistant used by our staff)	Formatting the data a customer gives us for onboarding (its lists of customers, sites, contacts and users) into our import template, only for a customer that agreed to it on its Order Form. A person at Tradeforce checks the result before anything is imported. Model training on this data is switched off in the tool's settings	The onboarding data the customer provides: end-customer names, site addresses, contact names, emails and phone numbers, and the customer's users' names and emails	United States

2. Other recipients (not Subprocessors; listed for transparency)

Party	What it receives	Why it is not a Subprocessor
Have I Been Pwned (Pwned Passwords API, delivered via Cloudflare)	The first five characters of a one-way hash of a new password, and our server's IP address	Receives no personal information ("k-anonymity" check against known breached passwords)
GitHub, Inc.	Source code and automated tests using synthetic data	No Customer Data is placed there
GoDaddy.com, LLC	Domain registration and DNS for tradeforcepros.com; hosts our marketing website	The application does not run on GoDaddy [FOUNDER TO CONFIRM what the marketing site collects]

We use no advertising networks, data brokers, analytics or session-replay services. The only artificial- intelligence provider is Anthropic (Section 1), which our staff use to format onboarding data for a customer that agreed to it. The product itself has no AI feature. We will update this list, with notice under DPA §7.4, before any AI-assisted feature in the product processes Customer Data.

2a. AI-assisted features in the product (none today)

The product has no AI-assisted feature today. Before one processes any customer's data, both of these must hold:

1. Its provider is listed in Section 1, with the 30 days' notice of Section 3.
2. That customer has given written consent on its Order Form. A customer that has not consented never has its data sent to the provider.

Our staff's use of Anthropic for onboarding (Section 1) already follows both rules: it is listed, and it is used only for a customer whose Order Form carries its consent (R-319 G5).

3. Changes and notices

• We give at least thirty (30) days' notice before a new Subprocessor processes Customer Data, by email to each customer's Owner(s) and by updating this page. Customers may object as described in DPA §7.4.
• In an emergency (for example replacing a failed provider), we may give shorter notice and will give it as soon as practicable.
• To receive notices at another address, email [privacy@tradeforcepros.com] with the subject "Subprocessor notices."

4. Change log

Version	Date	Change
0.1-draft	2026-10-17	First draft, verified against the codebase
0.2-draft	2026-10-24	Anthropic, PBC (Claude) added to Section 1: our staff use it to format a consenting customer's onboarding data, with model training switched off (R-319 G5). §2a (first drafted 2026-10-22, R-313 M7) now covers only future in-product AI features, with listing and Order Form consent before any of them processes Customer Data