Subprocessors
Last updated: July 6, 2026
Introduction
OpsCommon LLC ("OpsCommon") uses the following third-party subprocessors to assist in providing our operations management platform. A subprocessor is a third-party data processor engaged by OpsCommon that may process personal data on behalf of our customers.
This page provides transparency into who our subprocessors are, what data they process, and where that processing occurs.
Current Subprocessors
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Convex | Real-time database and backend infrastructure | All application data including operations, map features, tasks, teams, events, and files | US (AWS) |
| Clerk | Authentication and identity management | User identity data (name, email, avatar, organization membership) | US |
| Stripe | Payment processing and subscription management | Organization ID, billing address, subscription and payment data | US (AWS) |
| SendGrid (Twilio) | Transactional email delivery — notification emails, activity digests, billing and account lifecycle emails, and delivery of contact-form messages to our support inbox | Recipient email address and name, email content (which may reference operation, task, or event names) † | US |
| Loops | Newsletter delivery for the opscommon.com marketing site (opt-in only) | Email address, name (when provided via the contact form opt-in), subscription status | US |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Web push notification delivery to your devices (opt-in, per device) | Device push endpoint and delivery metadata; notification payloads are end-to-end encrypted, so push services cannot read their content ‡ | US (Global edge) |
| Mapbox | Map rendering, geocoding, and terrain services | Viewport coordinates, search queries, API token with tile requests | US (AWS), CDN global * |
| Sentry | Error monitoring and performance tracking (consent-gated) | Error reports, user ID, organization ID, performance traces, session replay (sampled) | US (GCP) |
| PostHog | Product analytics (consent-gated) | User ID (account identifier), email, name, organization ID and name, page views, and a defined set of product events (e.g. operation created, task created, billing portal opened, map PDF exported) *** | US |
| OpenWeatherMap | Weather data and forecasts | GPS coordinates (reduced precision, via server-side proxy) ** | UK (London HQ) ** |
| Cloudflare (Workers, Pages, DNS) | Application hosting, content delivery, DNS | HTTP requests, deployed application code and assets | US (Global edge) |
| Cloudflare Turnstile | Bot protection on sign-up and public-facing forms: account sign-up, support contact and feature request forms in the product, and the contact and newsletter forms on opscommon.com | Challenge response token, IP address, browser fingerprint signals supplied by Cloudflare | US (Global edge) |
Notes
* Mapbox CDN: Map tile requests may be served from global CDN edge nodes for performance. These are ephemeral requests only — no customer data is persistently stored at CDN edge locations. All primary Mapbox data processing occurs in the United States.
** OpenWeatherMap: OpenWeatherMap is headquartered in London, UK, with offices in Cyprus and the United States. All weather data requests from OpsCommon are routed through our server-side proxy, which reduces coordinate precision to approximately 1.1km before the request reaches OpenWeatherMap. Your API keys and full-precision coordinates are never sent directly from your browser to OpenWeatherMap.
*** PostHog: Product analytics is only initialized when you accept analytics via the consent banner. If you reject analytics, PostHog operates in an opted-out state and no events are captured. When you reject after a prior acceptance, the locally stored PostHog distinct ID is also cleared. PostHog sets first-party cookies and uses local storage to maintain a session and a distinct ID. While signed in, your account ID is used as the PostHog identifier and your email, name, organization ID and organization name are sent as person properties so we can understand product usage at the account and organization level. See PostHog's privacy policy.
† SendGrid: Used for transactional email only (notifications, digests, billing and account lifecycle emails) — we do not send marketing email through SendGrid. Click and open tracking are disabled on our transactional emails. You can control which notification emails you receive in your in-app notification settings.
‡ Browser push services: Web push notifications are opt-in per device. When you enable them, your browser vendor's push service (Google FCM, Mozilla, Apple, or Microsoft, depending on your browser) delivers the notification to your device. Payloads are encrypted end-to-end using keys held by your browser, so the push service cannot read notification content. You can review and disconnect enrolled devices at any time from the app's settings.
Loops: Used only for the opt-in newsletter on the opscommon.com marketing site. The newsletter signup form submits your email address directly to Loops; if you opt in via the contact form, your email and name are added to the newsletter list server-side. Every newsletter includes an unsubscribe link. Loops does not set cookies on our sites.
Changes to Subprocessors
We will provide at least 30 days' notice before adding new subprocessors or making material changes to how existing subprocessors process customer data. Notifications of changes will be posted on this page and communicated to customers with active Data Processing Agreements.
If you have concerns about a new subprocessor, you may contact us within the notice period to discuss the change.
Data Processing Agreement
For details on how OpsCommon processes data on behalf of customers, including security measures, data subject rights, and international transfer mechanisms, please see our Data Processing Agreement.
Contact
For questions about our subprocessors or data processing practices, please contact us:
OpsCommon LLC
Email: [email protected]
See also our Privacy Policy, Security, and Data Processing Agreement.