Subprocessors
Last updated October 11, 2026 · Version 2026-10-11
To provide the Service, we rely on the third-party providers ("subprocessors") below. We share only what each one needs for its stated purpose, and we do not sell your information. This list may change as the Service evolves; we post updates here. See our Privacy Policy and Data Processing Addendum for how we handle data with these providers.
| Subprocessor | Purpose | Data involved | Region |
|---|---|---|---|
| Cloud hosting / VPS provider | Host, store, secure, and back up the Service | All Customer Data | United States |
| Proton (Proton Drive) | Encrypted off-site backup storage | Full account and database backups, encrypted before upload — the provider holds only ciphertext | Switzerland / EU |
| Square | Process dues, donations, refunds; fraud prevention | Payment details (no full card numbers stored by us) | United States |
| Plaid | Only where you choose to pay by bank transfer (ACH). Verifies the bank account on Square's behalf | The bank login you enter in Plaid's own window, and the resulting account and routing details. None of this reaches us — we receive only a payment token and the last four digits | United States |
| Mailgun | Send transactional and permitted email | Recipient email address and message content | United States |
| Proton (Proton Mail) | Our support inbox and support-ticket correspondence | Whatever you put in an email or a support ticket — including any member details you choose to send us. Please do not email us Social Security numbers or medical records. | Switzerland / EU |
| Proton (Proton Meet) | Demonstrations, onboarding sessions and customer meetings | Your name, the meeting audio and video, and anything shown on screen during the session | Switzerland / EU |
| Meta (Facebook) · Google (YouTube) · comparable platforms | Only where a session is deliberately recorded or live-streamed as a public demonstration | The recorded or streamed audio, video and screen content, and the name of anyone who appears or speaks. We tell every participant before a session is recorded or streamed, and we do not use live customer data in one. | United States |
| Active911 | Optional CAD / dispatch board integration | Dispatch alert data (opt-in) | United States |
| NERIS (Fire Safety Research Institute) | National incident reporting, where your Department submits incidents | Incident addresses and coordinates, patient-care evaluation, transport disposition, and casualty and fatality records | United States |
| Google — Firebase Cloud Messaging | Delivering dispatch and notice notifications to Android phones and tablets. This is the only notification transport available on a standard Android device. Google's terms state their messaging APIs are not designed for emergency alerting — which is why the Responder App is supplemental and your primary alerting must stay in place. | The device's push token, and the notification content itself: call type, address, incident number and department name. No member names and no personal details are placed in a notification. | United States |
| Google — maps & fonts | Map embeds on dispatch and pre-incident screens, and web fonts on display boards. We do not use Google Analytics or any other analytics product. | Incident and station coordinates shown on a map; standard request data (such as IP address) when a font or map loads | United States |
| Apple — Push Notification service | Delivering dispatch and notice notifications to iPhones and iPads, once the iOS application is released. Subject to the same limitation as Android push: it is not designed for emergency alerting, and your primary alerting must stay in place. | The device's push token and the notification content: call type, address, incident number and department name. No member names or personal details. | United States |
| OpenStreetMap, Nominatim, and Overpass | Address lookup and mapping on incident and pre-incident forms, where the request is made by your browser; and, as a last-resort fallback when the Census geocoder cannot place a dispatch address, a lookup made from our servers. Nominatim and Overpass are community-operated services. | Street addresses and coordinates you type into those forms, and dispatch incident addresses as text on the fallback lookup. No caller name, no telephone number, no medical detail and no member information are ever sent. | European Union / global |
| Microsoft 365 | Optional roster / directory sync | Roster data (opt-in) | United States |
| ProdataKey (PDK) | Optional door access control | Access credentials and unlock commands (opt-in) | United States |
| US Census Bureau geocoder; AirNow (US EPA) | Deriving map coordinates for dispatch incident addresses and for station addresses, and air-quality display on station boards. The 911 feed does not supply a map position, so the Service looks the address up — see Addresses, mapping, and geocoding in our Terms. | The incident or station street address, municipality, county and state as text, sent from our servers. No caller name, no telephone number, no medical detail and no member information are ever sent to a geocoder. | United States |
| ntfy.sh | Operator security and system alerting | A content-free "a critical alert was raised" ping only — no alert text, no member records | European Union |
| Healthchecks.io | Scheduled-job liveness monitoring | None — a bare ping containing no Customer Data | United States |
| Anthropic (Claude) | AI-assisted drafting and data import; internal software development, code review, and debugging | Only the content submitted to an AI-assisted feature; where used for development against production data, that data | United States |
| OpenAI | AI-assisted data import | Only the content submitted to an AI-assisted feature | United States |
| Proton (Lumo) | AI-assisted drafting | Only the content submitted to an AI-assisted feature | Switzerland / EU |
| Local, non-networked AI models | On-server processing where a feature uses a model we run ourselves | Does not leave our infrastructure — not a subprocessor. Listed for transparency only. | Our own servers |
Questions about a subprocessor, or need a signed DPA? Contact us.