Subprocessors
Last updated: June 8, 2026
ioZen uses the following third-party sub-processors to deliver our Service. All sub-processors are bound by data processing agreements with obligations no less protective than our Data Processing Agreement.
Current Sub-processors
Infrastructure
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Supabase | Database, authentication, storage | United States | Account data, user content, authentication credentials |
| Vercel | Application hosting, deployment, AI Gateway, file storage (Blob) | United States | Application data, usage logs, AI request routing, file uploads and exports |
| Cloudflare | CDN, DDoS protection, DNS | Global (US-based) | IP addresses, traffic data |
| Upstash | Redis caching, message queues (QStash), rate limiting | United States | Session data, job queues, rate limit counters |
| Postmark | Transactional email (notifications, invitations, alerts) | United States | Email addresses, notification content |
| Stripe | Payment processing | United States | Payment information, billing details |
Conversion & Attribution
When customers enable marketing attribution and conversion tracking, submission data may be sent to the following ad platforms via server-side APIs. All personally identifiable information (PII) is SHA-256 hashed before transmission.
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Meta (Facebook/Instagram) | Conversions API: server-side conversion event tracking | United States | Hashed user data (email, phone), event name, event value, click ID (fbclid) |
| Measurement Protocol: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (gclid) | |
| Conversions API: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (li_fat_id) | |
| TikTok | Events API: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (ttclid) |
Integrations & Automation
When customers configure action blocks on an Intake Bot, submission data is routed through Composio to execute the configured integration action. Only the fields the customer explicitly maps to an action block parameter are transmitted. Composio then forwards those values to the target integration on the customer’s behalf.
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Composio | Integration execution layer for action blocks. Routes customer-mapped submission fields to third-party tools (HubSpot, Zoho CRM, Slack, Monday, Mailchimp, and others) | United States | Submission field data explicitly mapped by the customer to action block parameters (may include names, email addresses, phone numbers, and other case data) |
Note: The destination integrations (HubSpot, Zoho, Slack, etc.) receive only the data the customer maps in each action block. Those integrations are governed by their own privacy policies and data processing terms. Customers are responsible for ensuring they have the appropriate basis to send their end-users’ data to the tools they configure.
AI Providers
All AI processing is routed through Vercel AI Gateway. User content submitted to AI features never includes Private or Encrypted fields. The following AI providers may process data depending on the model selected:
| Sub-processor | Purpose | Location | Models |
|---|---|---|---|
| OpenAI | AI-powered features (form generation, field intelligence, validation) | United States | GPT-4o, GPT-4o Mini, O1 |
| Anthropic | AI-powered features (form generation, field intelligence, validation) | United States | Claude Sonnet 4, Claude 3.5 Haiku, Claude Opus 4 |
| AI-powered features (form generation, field intelligence, validation) | United States | Gemini 2.5 Flash, Gemini 2.5 Flash Lite | |
| xAI | AI-powered features (form generation, field intelligence, validation) | United States | Grok 2, Grok 3 |
Changes to Sub-processors
We will notify customers of any new sub-processors at least 30 days before they begin processing personal data. As described in our DPA, you may object to a new sub-processor within 30 days of notification.
Stay Informed
To receive notifications about sub-processor changes, email us at [email protected] with the subject line “Sub-processor Updates”.
Questions
If you have questions about our sub-processors or their data practices, contact us at [email protected].