Sub-processors

SiteSui LLC runs Sitesui on a small number of other companies’ services. This page names every one of them that can touch data a customer puts into Sitesui, says what it does, what personal data it can see, and where it processes. It is the list the Data Processing Addendum refers to, and it is kept in step with the code rather than written once and forgotten.

The list

Each of these processes personal data on a customer’s behalf, under a written agreement with obligations equivalent to our own. Rows marked optional only run while that capability is switched on — by us, when the provider’s key is configured, and for resident-report triage also by each workspace, where it is on until an owner or admin turns it off; with it off, nothing reaches that company at all.

Where a region is not named

Our commitment is in DPA §9: the Service is operated from the United States, and customers subject to GDPR or UK GDPR are covered by the Standard Contractual Clauses there. Where the rows above name a region, that is the region the service is configured to use, and the database of record — every inspection, photo and report — is in one named United States region.

Two places we have not yet pinned to a region ourselves, and would rather say so than imply otherwise: the backup bucket at Cloudflare carries no jurisdiction restriction, and the machine that runs the nightly backup job is chosen by the host. Both hold a copy, never the live records. Pinning them is on our list; if your review needs it done before you sign, say so and we will do it and confirm it in writing. Vercel’s edge network also terminates a request close to the visitor, wherever the visitor is.

What is deliberately not on the list

• Browser push services (Apple, Google, Mozilla) — When a staff member turns on browser notifications, the alert goes to whichever push service their browser issued an address for — a short title and line such as "New inspection assigned", never a report, a photo or a resident's details. They are the person's own browser vendor, not a provider we chose.
• Unsplash — Stock photography for our own blog posts. It never receives anything of a customer's.
• Advertising and tracking networks — There are none. No advertising pixel, no third-party analytics script, and no customer data is sold or shared for advertising.
• AI model training — Nothing a customer puts into Sitesui is used to train a model, by us or by a provider.

Changes, and being told about them

This page is updated when the list changes, and the date at the top moves with it. Under DPA §2 we give at least 30 days’ notice by email before a new sub-processor starts processing customer personal data; a customer may object in writing and, if the objection cannot be resolved, terminate without penalty.

To be on that notice list, email hello@sitesui.app and say which address should receive it. You can also ask for the DPA signed, or for anything on this page in the form your own questionnaire wants it — the standard answers are already published, and how the data is protected is set out in full.