Third-Party Subprocessors

A list of third-party services that process data on behalf of JobsiteOn, including their purpose and data residency.

Written by Maya ThompsonUpdated over a week ago3 min readBeginner

Current subprocessors

Subprocessor	Purpose	Data residency
Neon	PostgreSQL database hosting	United States
Upstash	Redis cache, QStash queues, realtime events	United States
Railway	API hosting and background worker runtime	United States
Vercel	Web app hosting and edge delivery	Global (edge)
Cloudflare	DNS, security edge, Turnstile, R2 storage	Global
Resend	Transactional and inbound email delivery	United States
Stripe	Payment processing and subscription billing	United States
Twilio	SMS delivery and SMS webhook processing	United States
Intuit (QuickBooks)	Optional accounting integration	United States
Google services	Optional Gmail, Calendar, Contacts, analytics	Global
Sentry	Error monitoring and diagnostics	United States
OpenAI	AI Foreman model processing, when configured	United States
Anthropic	AI Foreman model processing, when configured	United States
Groq	AI Foreman model processing, when configured	United States
OpenRouter	AI model routing, when configured	United States

Subprocessor

Purpose

Data residency

Neon

PostgreSQL database hosting

United States

Upstash

Redis cache, QStash queues, realtime events

United States

Railway

API hosting and background worker runtime

United States

Vercel

Web app hosting and edge delivery

Global (edge)

Cloudflare

DNS, security edge, Turnstile, R2 storage

Global

Resend

Transactional and inbound email delivery

United States

Stripe

Payment processing and subscription billing

United States

Twilio

SMS delivery and SMS webhook processing

United States

Intuit (QuickBooks)

Optional accounting integration

United States

Google services

Optional Gmail, Calendar, Contacts, analytics

Global

Sentry

Error monitoring and diagnostics

United States

OpenAI

AI Foreman model processing, when configured

United States

Anthropic

AI Foreman model processing, when configured

United States

Groq

AI Foreman model processing, when configured

United States

OpenRouter

AI model routing, when configured

United States

Screenshot: A table of subprocessors with their logos, purposes, and data residency locations.

What data each subprocessor receives

Neon -- account, organization, workspace, billing, and operational database records.

Upstash -- cache keys, queue payloads, realtime event metadata, and transient job state.

Railway -- request, account, and workspace data processed by the API services and background jobs.

Vercel -- web request metadata, routing metadata, and application delivery logs.

Cloudflare -- DNS/security request metadata, Turnstile challenge data, and R2-hosted file attachments or import artifacts.

Resend -- recipient addresses, sender addresses, email bodies, headers, and attachments needed for transactional and workspace email.

Stripe -- payment amounts, customer billing identifiers, card/payment tokens, subscriptions, and invoice/payment metadata.

Twilio -- phone numbers, SMS bodies, delivery status, and inbound SMS webhook metadata.

Intuit -- contacts, invoices, items, payments, and sync metadata when QuickBooks is connected.

Google services -- selected Gmail, Calendar, Contacts, OAuth profile, and analytics event data when those features are connected or enabled.

Sentry -- error telemetry, stack traces, release metadata, and limited request/user context needed to diagnose incidents.

OpenAI, Anthropic, Groq, and OpenRouter -- scoped prompts, retrieved JobsiteOn context, model routing metadata, and generated responses when AI Foreman is used through that provider route.

How subprocessors are evaluated

Before engaging a new subprocessor, JobsiteOn evaluates:

Security certifications (SOC 2, ISO 27001, etc.).

Data protection policies and practices.

Incident response capabilities.

Contractual data protection commitments.

Animation: A flowchart showing the subprocessor evaluation process from initial review through security assessment to contract execution.

Changes to the subprocessor list

When we add or change a subprocessor:

We update this list and the public privacy policy.

We record the effective date in the article metadata.

We notify affected customers as required by contract, law, or a signed DPA.

Note: This article is the current public subprocessor list. For legal, security, or DPA requests, email privacy@jobsiteon.com.

Third-Party Subprocessors

What this guide covers

Current subprocessors

What data each subprocessor receives

How subprocessors are evaluated

Changes to the subprocessor list

Related Articles

What this guide covers

Current subprocessors

What data each subprocessor receives

How subprocessors are evaluated

Changes to the subprocessor list

Related articles

Related Articles