Sub-processors
DRAFT for attorney review. Not legal advice.
EdgeQuote uses the sub-processors below to operate the Service. Each processes personal data only to provide its function, under a data processing agreement with appropriate safeguards, including Standard Contractual Clauses where personal data leaves its origin region.
| Sub-processor | Role | Personal data it touches | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, scheduled jobs | All Service data in transit and in memory during a request; request logs | USA (global edge) |
| Neon Inc. | Managed PostgreSQL database and backups | All Service data at rest, including leads, job photographs, and account records | USA (AWS us-east-1) — confirmed 2026-09-03 against the production connection string |
| Resend Inc. | Transactional email: lead notifications to Contractors, estimate recap to homeowners, sign-in links, operational digests | Recipient name and email address, message content including the estimate and the answers summary | USA |
| Twilio Inc. | SMS notification to a Contractor when a lead arrives, where the Contractor enables it | Contractor's mobile number and the message content, which includes the homeowner's name and the estimate | USA (global carrier routing) |
| Cloudflare Inc. | Turnstile bot verification on public forms | Traffic metadata and a challenge token. Cloudflare states Turnstile does not use cookies for tracking and does not collect personally identifiable information for advertising | USA/global |
No payment processor. EdgeQuote holds no card data and integrates no payment provider. Fees, where charged, are invoiced outside the application. [PLACEHOLDER — if a payment processor is added, it must be listed here before it goes live.]
No analytics or advertising provider. There is no Google Analytics, no advertising pixel, no session-replay or heat-mapping tool, and no third-party tag manager anywhere in the estimator, the widget, or the dashboard. Usage figures are counted on our own server and stored as daily totals per Contractor with no per-visitor record.
No AI provider. EdgeQuote has no AI features and sends no data to any model provider.
Destinations you connect are not our sub-processors. If you configure a webhook, lead data flows to the address you specify on your instruction, and your agreement with whoever operates that address governs it.
Changes. We will give at least 30 days' notice by email and update this page before adding or replacing a sub-processor that handles personal data. A Contractor who reasonably objects on data-protection grounds may terminate the affected Service without penalty, as set out in Section 6 of the DPA.
Questions: sebastien@beyondtheedgestudio.com
NOTES FOR YOUR LAWYER
- The Neon region is confirmed as US, and it matters. The production database is provisioned in AWS
us-east-1. Every French contractor's homeowner data therefore rests in the United States, which makes this a Chapter V transfer for every single lead, not an occasional one. The SCCs cited in DPA Section 10 are consequently the operative basis for the core of the Service, not a fallback, so the executed sub-processor paperwork has to actually exist. If that is not acceptable, Neon supports EU regions and the decision to stay inus-east-1should be a deliberate, recorded one rather than a default. - Twilio's routing is global by design. An SMS to a French mobile traverses carriers we do not select. The message body contains a homeowner's name and their estimate. Confirm this is acceptable, or consider suppressing personal detail from the SMS body and making it a "new lead, open your dashboard" notification instead.
- Turnstile's characterisation. The statement that Turnstile sets no tracking cookie relies on Cloudflare's own documentation. If the Cookie Statement leans on that claim, verify it against Cloudflare's current published position rather than this table.
- Verify every DPA. Obtain and retain the current signed or referenced DPA for each of the five providers above, and check each incorporates the 2021 SCCs with the right module and the UK Addendum.
WHAT THIS DOES NOT COVER
- Onward sub-processors engaged by the providers above. Each provider maintains its own list.
- Any destination a Contractor connects.
- Infrastructure used only for our own business administration and not to process Service data.