Sub-processors
These are the third parties Depot engages to process personal data on our customers’ behalf. This page is referenced by our Data Processing Addendum and our Privacy Policy, so that adding or replacing a vendor does not require amending either document.
The Depot application
- Supabase, Inc. — application hosting, database, file storage, and authentication. Company in the United States; data is stored in Canada, in a Montreal region.
- Resend, Inc. — transactional email: sign-in codes, invitations, and operational notifications. United States.
- Functional Software, Inc. (Sentry) — crash and error diagnostics. United States.
- Capgo (Digital Solutions AG) — delivery of application updates; processes basic device and app-version information. Switzerland.
- Cloudflare, Inc. — content delivery and security for the web application. United States.
- Google LLC — Firebase Cloud Messaging, used to deliver push notifications to mobile devices. United States.
- Mapbox, Inc. — maps of equipment locations (a map image on an asset and an interactive fleet map); receives the equipment coordinates stored in Customer records for the equipment in view, the map area viewed, and standard request information (IP address, device or browser type), and records map loads for usage metering. When the interactive fleet map is shown, Mapbox GL JS also sends Mapbox a map-load event and a performance event that includes interaction timing, for app functionality and analytics. United States.
- Google LLC (ML Kit) — on-device barcode scanning in the Android application; the camera image stays on the device, and ML Kit sends Google device information, app information, and performance and diagnostic metrics. United States.
- Anthropic PBC — artificial-intelligence models that interpret text, images, and audio submitted to the Service. Engaged on commercial terms under which content sent through their API is not used to train their models. United States. Not currently processing: artificial-intelligence features are not enabled in the Service, and no customer content has been sent to this provider. Listed in advance so that enabling those features does not require fresh notice.
- OpenAI, L.L.C. — artificial-intelligence models that interpret text, images, and audio submitted to the Service. Engaged on API terms under which content sent through their API is not used to train their models. United States. Not currently processing: as above.
This website, sales enquiries, and support
- Cloudflare, Inc. — website hosting, content delivery, server logs, and the Turnstile bot check. United States.
- Supabase, Inc. — database hosting for Depot’s internal sales and support system, where enquiries are stored. Company in the United States; data is stored in Canada, in a Montreal region.
- Google LLC (Google Workspace) — email and document services used to correspond about enquiries. United States.
- Stripe, Inc. — payment processing for subscriptions. Stripe receives name, email, and payment details; Depot never receives or stores full card numbers. United States.
- X.AI LLC — artificial-intelligence assistants used inside Depot’s internal sales and support system. They read enquiry, prospect, and support records, and the directory of customer organizations, branches, and users that the Depot application copies into that system, in order to draft replies and summaries for a member of Depot staff. Every read is recorded. The assistants cannot approve an action; a person does. Engaged on terms under which content sent through the API is not used to train their models. United States.
Telephone support and sales calls
If you call one of our published telephone numbers, the call is recorded and transcribed. You hear a notice to that effect before anyone at Depot is connected. Calls we place to you are not recorded.
- Telnyx LLC — telephone numbers, call routing, and call recording. Receives your telephone number, the number you dialled, and the call audio. United States.
- Deepgram, Inc. — speech-to-text transcription of recorded calls. Receives the call audio. United States.
Recordings and transcripts are stored in access-restricted object storage operated by Cloudflare, Inc. within North America, which may place them in the United States, and are deleted no later than 24 months after the call.
Not sub-processors
Where a customer connects their own telematics provider (for example Geotab) to Depot, that provider is the customer’s vendor, not a Depot sub-processor. Depot reads data from it at the customer’s direction and under the customer’s own agreement with that provider.
Depot also uses operational tooling that never receives personal data and is therefore not listed above: Slack and ntfy carry deployment and infrastructure alerts, Healthchecks.io receives scheduled-job heartbeats, GitHub holds source code, and 1Password holds staff credentials. None of these receives customer records, and a change to any of them is not a sub-processor change.
Changes to this list
We notify customers before a new sub-processor begins processing personal data, using the notice method set out in the Data Processing Addendum. A customer may object on reasonable data-protection grounds within the period stated there; if no objection is raised in that period, the new sub-processor is treated as approved.
Checking this page is not a substitute for that notice, and publishing a change here does not by itself start the objection period.
Contact
Questions about this list: support@thedepot.io.