1. About this list
Bitscaled LLC publishes the vendors that may process data in connection with our websites, portals, VaultTools, and contracted processor services. This page wraps our current inventory. It should be read with the Data Processing Agreement and Privacy Policy.
Core vendors are used in ordinary provision of the website or processor services. Optional vendors are environment-gated or used only when a product, integration, consent category, or client contract is enabled.
2. Current subprocessors
| Vendor | Role | Purpose | Location | When used |
|---|---|---|---|---|
| Vercel Inc. | Hosting | Website, application hosting, edge delivery, and cookieless Web Analytics / Speed Insights. | United States | Core |
| Supabase / PostgreSQL provider | Hosting | Primary application database for accounts, CRM, billing, tickets, and legal signatures. | United States | Core |
| MongoDB (content database) | Hosting | Article content and public newsletter subscriber records. | United States | Core |
| Upstash Redis | Hosting | Optional queue, cache, and rate-limit storage when configured. | United States | Optional |
| Twilio SendGrid | Communications | Fallback transactional and marketing email delivery, event webhooks, and inbound parse when SendGrid is configured as the secondary outbound provider. | United States | Optional |
| Google LLC (reCAPTCHA, optional Maps, optional Gemini) | Security | Bot protection on public forms (contact, login, invite accept, VaultSandbox spoof-test); intranet address lookup; optional Gemini draft/image features. | United States | Core |
| Google Analytics 4 | Analytics | Public-site usage measurement after analytics cookie consent. | United States | Optional |
| Datadog, Inc. | Analytics | Application monitoring. Browser RUM and session replay on public pages require analytics consent. | United States | Optional |
| PayPal | Payments | Workspace invoice checkout when a client pays an invoice online. | United States | Optional |
| Microsoft (Microsoft 365 / Graph, optional Entra app) | Productivity | Optional Microsoft 365 security snapshot and contracted Microsoft 365 administration. | United States / customer tenant | Optional |
| Zoom | Communications | Optional CRM meeting/phone sync for Bitscaled operations, not public website pages. | United States | Optional |
| Discord | Operations | Optional internal CRM notifications, approval workflows, and Workspace client channels when configured. | United States | Optional |
| SignalWire | Communications | Voice/SMS call flows for contracted clients that use Bitscaled-managed telephony. | United States | Optional |
| Namecheap VPS / Bitscaled VaultTools host | Hosting | Public security tools gateway (vaulttools.bitscaled.tech) and related microservices. | United States | Core |
| VaultSandbox (email spoof test environment) | Security | Authorized SMTP spoof testing for domains the requester is allowed to test. | United States | Optional |
| Public breach-index lookup | Security | Optional exposure checks for emails or domains submitted to Bitscaled security tools. | United States / provider regions | Optional |
| Apollo, Clay, Lusha, Parallel | Operations | Optional B2B CRM enrichment and optional article-automation validation for Bitscaled operations (not Client end-user files unless an SOW says otherwise). | United States | Optional |
| Resend | Communications | Primary transactional and marketing email delivery and event webhooks when Resend is configured. | United States | Core |
| OpenAI, LLC | Operations | Optional Workspace and Intranet AI model provider when configured. | United States | Optional |
| Anthropic | Operations | Optional Workspace and Intranet AI model provider when configured. | United States | Optional |
| Google Workspace (Gmail, Drive, Calendar, Meet) | Productivity | Staff productivity when Bitscaled personnel process Client Data in email, files, scheduling, or meetings. This listing does not claim SOC 2 or HIPAA certification. | United States | Optional |
| Google Workspace eSignature | Productivity | Optional e-sign of MSA, NDA, SOW, BAA, and DPA when configured for a client. | United States | Optional |
3. Optional and environment-gated vendors
Optional rows are not "always on." Examples include Redis or queue storage when configured, Google Analytics and Datadog RUM after analytics consent, PayPal checkout when a client pays an invoice online, Microsoft Graph snapshots, Zoom or Discord for Bitscaled operations, SignalWire for contracted telephony, VaultSandbox spoof testing, and breach-lookup providers used by VaultTools.
Vendors currently marked Optional: Upstash Redis; Twilio SendGrid; Google Analytics 4; Datadog, Inc.; PayPal; Microsoft (Microsoft 365 / Graph, optional Entra app); Zoom; Discord; SignalWire; VaultSandbox (email spoof test environment); Public breach-index lookup; Apollo, Clay, Lusha, Parallel; OpenAI, LLC; Anthropic; Google Workspace (Gmail, Drive, Calendar, Meet); Google Workspace eSignature.
4. CRM enrichment vendors
Apollo, Clay, Lusha, and Parallel are used for Bitscaled CRM enrichment of Bitscaled business contacts. They are not used to process the Client's end-user files or customer records as a processor under the DPA unless a signed SOW expressly says otherwise.
5. How to object
If you are a Client whose Client Data we process under the DPA, you may object to a material new subprocessor used for those processor services by emailing legal@bitscaled.tech. Include your organization name, the vendor, and the reason. We will discuss a commercially reasonable alternative as described in the DPA.
6. Updates
We update this page when the inventory changes. The version and effective date on this document identify the published list. Check back here rather than relying on an emailed copy unless your MSA requires a different notice method.
7. Contact
Questions: legal@bitscaled.tech or privacy@bitscaled.tech.
8. Enterprise vendor assurance
The following directory highlights four infrastructure and communications providers. It supplements the complete inventory above. Jurisdictions reflect the published vendor inventory and are not a contractual guarantee of exclusive data residency.
| Vendor | Service and jurisdiction | When used | Certification evidence | Scope |
|---|---|---|---|---|
| Vercel Inc. | Website, application hosting, edge delivery, and cookieless Web Analytics / Speed Insights. Jurisdiction: United States. | Core provider | Vercel security and compliance | Consult Vercel for current certification scope, audit reports, and hosting controls. |
| Supabase / PostgreSQL provider | Primary application database for accounts, CRM, billing, tickets, and legal signatures. Jurisdiction: United States. | Core provider | Supabase security | Consult Supabase for current audit reports and controls for the contracted database service. |
| Twilio SendGrid | Fallback transactional and marketing email delivery, event webhooks, and inbound parse when SendGrid is configured as the secondary outbound provider. Jurisdiction: United States. | Optional, when configured | Twilio security overview | Confirm that Twilio assurance documents cover the SendGrid services in your agreement. |
| Datadog, Inc. | Application monitoring. Browser RUM and session replay on public pages require analytics consent. Jurisdiction: United States. | Optional, when configured | Datadog security and compliance | Consult Datadog for current certifications, report access, and monitoring service scope. |
These first-party references are a starting point for reviewing certification scope and requesting current reports. Listing a vendor does not verify an active certification for your service or transfer that certification to Bitscaled. Confirm the contracted service, report period, region, and any required BAA with the provider.
9. Change notification requests
Request subprocessor change notifications from our legal team. Include your organization and the contact address for notices. This opens an email request; it does not automatically subscribe you to a notification service. The notice method and timing follow your signed agreement.
Clients may object to material new subprocessors for processor services as described in DPA section 7. The request does not change the published inventory or authorize a new processing purpose.