Subprocessors
Last updated: May 13, 2026
Introduction
OpsCommon LLC ("OpsCommon") uses the following third-party subprocessors to assist in providing our operations management platform. A subprocessor is a third-party data processor engaged by OpsCommon that may process personal data on behalf of our customers.
This page provides transparency into who our subprocessors are, what data they process, and where that processing occurs.
Current Subprocessors
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Convex | Real-time database and backend infrastructure | All application data including operations, map features, tasks, teams, events, and files | US (AWS) |
| Clerk | Authentication and identity management | User identity data (name, email, avatar, organization membership) | US |
| Stripe | Payment processing and subscription management | Organization ID, billing address, subscription and payment data | US (AWS) |
| Mapbox | Map rendering, geocoding, and terrain services | Viewport coordinates, search queries, API token with tile requests | US (AWS), CDN global * |
| Sentry | Error monitoring and performance tracking (consent-gated) | Error reports, user ID, organization ID, performance traces, session replay (sampled) | US (GCP) |
| PostHog | Product analytics (consent-gated) | User ID (account identifier), email, name, organization ID and name, page views, and a defined set of product events (e.g. operation created, task created, billing portal opened, map PDF exported) *** | US |
| LiveKit | Real-time voice rooms for operation teams (consent-gated) | Microphone audio, participant identity (name, mute status), connection metadata while connected | US (Global edge) |
| OpenWeatherMap | Weather data and forecasts | GPS coordinates (reduced precision, via server-side proxy) ** | UK (London HQ) ** |
| Cloudflare (Workers, Pages, DNS) | Application hosting, content delivery, DNS | HTTP requests, deployed application code and assets | US (Global edge) |
| Cloudflare Turnstile | Bot protection on public-facing forms: support contact and feature request forms in the product, and the newsletter signup form on opscommon.com | Challenge response token, IP address, browser fingerprint signals supplied by Cloudflare | US (Global edge) |
Notes
* Mapbox CDN: Map tile requests may be served from global CDN edge nodes for performance. These are ephemeral requests only — no customer data is persistently stored at CDN edge locations. All primary Mapbox data processing occurs in the United States.
** OpenWeatherMap: OpenWeatherMap is headquartered in London, UK, with offices in Cyprus and the United States. All weather data requests from OpsCommon are routed through our server-side proxy, which reduces coordinate precision to approximately 1.1km before the request reaches OpenWeatherMap. Your API keys and full-precision coordinates are never sent directly from your browser to OpenWeatherMap.
*** PostHog: Product analytics is only initialized when you accept analytics via the consent banner. If you reject analytics, PostHog operates in an opted-out state and no events are captured. When you reject after a prior acceptance, the locally stored PostHog distinct ID is also cleared. PostHog sets first-party cookies and uses local storage to maintain a session and a distinct ID. While signed in, your account ID is used as the PostHog identifier and your email, name, organization ID and organization name are sent as person properties so we can understand product usage at the account and organization level. See PostHog's privacy policy.
LiveKit voice rooms: Voice connections are initiated only after you grant the in-app voice consent prompt. Microphone audio is transmitted live to other operation members and is not recorded by OpsCommon. Participant metadata (name, mute state) exists only while you are connected and is removed when you disconnect or are disconnected.
Changes to Subprocessors
We will provide at least 30 days' notice before adding new subprocessors or making material changes to how existing subprocessors process customer data. Notifications of changes will be posted on this page and communicated to customers with active Data Processing Agreements.
If you have concerns about a new subprocessor, you may contact us within the notice period to discuss the change.
Data Processing Agreement
For details on how OpsCommon processes data on behalf of customers, including security measures, data subject rights, and international transfer mechanisms, please see our Data Processing Agreement.
Contact
For questions about our subprocessors or data processing practices, please contact us:
OpsCommon LLC
Email: [email protected]
See also our Privacy Policy, Security, and Data Processing Agreement.