Legal / Version 2026-10-21-draft
Data Processing Addendum and Subprocessors
Draft for counsel review (2026-10-21). Before launch, confirm each provider's DPA is signed, its data region, and its retention and no-training terms for API data. Providers marked "planned" aren't in use yet.
Subprocessors
These service providers process personal information for us to run the Service. Each is bound by a contract that limits its use of the data to providing its service.
| Provider | What it does | Data it processes | Location | Status |
|---|---|---|---|---|
| [Hetzner Online] | Hosting, database, backups | All Service data (encrypted) | [EU (Germany) or US] | Planned |
| Cloudflare | DNS, TLS, network protection | IP addresses, request metadata | Global | Planned |
| Clerk | Sign-in and multi-factor authentication | Name, email, sign-in records | US | In use |
| Plaid | Bank and investment connections | Account and transaction data | US | In use (sandbox) |
| [OpenAI] | AI model for the advocate | The records and messages a task needs | US | Planned (production) |
| OpenRouter / TypeSafe (Jev) | Classification of settlement matches and notices | Merchant names, program descriptions, notice text | US | In use (limited) |
| Kernel or E2B | Cloud browsers that visit company websites for you | Pages the advocate visits, forms it fills | US | Planned |
| Postmark or Amazon SES | Sending email you approve | Recipient, message, attachments | US | Planned |
| Expo, Apple (APNs), Google (FCM) | Push notifications | Device token, notification text (kept short, no account details) | US | Planned |
| Stripe | Subscription and fee billing | Name, email, payment details | US | Planned |
| [Google Cloud KMS] | Encryption key management | Encryption keys only | [Region] | Planned |
We'll notify customers [30] days before adding or replacing a subprocessor.
Data Processing Addendum (outline)
For business customers (for example a credit union or employer offering Ombudly to members), a DPA will cover:
- Roles: the customer is the controller of member data it provides; Ombudly is a processor for that data and a controller for data members add themselves.
- Instructions: Ombudly processes only to provide the Service and as documented.
- Confidentiality of personnel; security measures (Annex: encryption, access control, MFA, logging, backups, incident response).
- Subprocessors: the list above, with notice and objection rights.
- Assistance with data subject requests, impact assessments and breach notification ([72] hours to the customer).
- Deletion or return of data at the end of the contract.
- Audits: SOC 2 report when available; otherwise questionnaires.
- International transfers: Standard Contractual Clauses (Module 2/3) and UK Addendum.