Subprocessors
Last updated: September 13, 2026
Isles Mechanical LLC uses the following subprocessors to deliver ServiceRunner. This list is Annex III to the Data Processing Addendum. It is updated before any new subprocessor begins processing customer personal data.
1. Current Subprocessors
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Cloud infrastructure provider (region selected by customer) | Hosting of the application, PostgreSQL database, Redis cache and queue, and S3-compatible object storage for photos, plans and files; backups. | All Customer Data and account data | Customer-selected region |
| Stripe, Inc. | Our subscription billing and, when a Customer enables its connected merchant account, end-client invoice card collection and recurring agreement payments; payment security and fraud prevention. | Billing contacts and organization details; for Customer collections, end-client and invoice identifiers, amounts, authorization and payment references, limited card details, and payment events. Full card details are entered into Stripe's secure fields and held by Stripe. | United States (with EU entities for EEA customers) |
| Resend, Inc. | Transactional email delivery (invitations, verification, password reset, notifications, quotes and reports sent by customers). | Recipient email address, name, message content | United States |
| Twilio Inc. | SMS delivery for notifications customers configure. Used only in deployments where SMS is enabled. | Recipient phone number, message content | United States |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery to iOS and Android devices and browsers. | Device push token, notification title and body | United States |
| Google LLC, Microsoft Corporation, Apple Inc. (single sign-on) | Identity verification when a user chooses to sign in with that provider. Engaged only if the deployment enables SSO and only for users who use it. | Name, email address, provider subject identifier | United States |
| Map tile provider (default: OpenStreetMap Foundation tile servers; a keyed provider such as MapTiler, Stadia Maps or CARTO may be configured) | Map tile imagery for site and dispatch maps, built on OpenStreetMap data. The browser or app fetches tiles directly. | IP address and the tile coordinates requested (which reveal the map area viewed) | United Kingdom / Netherlands (OSMF) or the configured provider's region |
| Apple Inc. (App Store) and Google LLC (Google Play) | Distribution of the mobile apps, crash reporting through the platform, and in-store account handling. Acting as independent controllers for store accounts. | Store account identifiers, app diagnostics as configured by the device owner | United States |
Customer-selected integrations can also disclose Customer Data directly to another provider. When a Customer connects QuickBooks Online and separately enables accounting sync, Intuit may receive customer contact details and issued invoices, payments and supported credits, and return company and transaction data for reconciliation. Intuit is identified here as a Customer-selected integration, not as our blanket DPA Subprocessor. Stripe, when processing for the Customer's connected merchant account, and Intuit may act as independent controllers for some activities and processors for others under their own terms and privacy notices: Stripe Privacy Policy; Intuit Privacy Statement.
Isles Mechanical affiliates and contractors who provide engineering or support may access Customer Data under confidentiality obligations and the DPA; they are not listed individually. Where a Customer self-hosts or chooses a dedicated deployment, the hosting provider and region are those selected by the Customer and stated in its Order.
2. Safeguards
Each subprocessor is bound by a written agreement that imposes data protection obligations no less protective than the DPA, including confidentiality, security measures and assistance with data subject rights. For transfers of EEA, UK or Swiss personal data to the United States we rely on the Standard Contractual Clauses (Module Three, processor to processor) and the UK Addendum, or on the recipient's certification under the EU-U.S., UK or Swiss-U.S. Data Privacy Framework. We review each subprocessor's security documentation before onboarding and periodically thereafter.
3. Change Notifications and Objections
We will publish changes on this page and notify Organization Owners and billing contacts by email or in-app notice at least 30 days before a new subprocessor begins processing Customer Personal Data. To receive notices at an additional address, or to object to a new subprocessor on data-protection grounds, email privacy@app.servicerunner.app. The objection procedure and remedies are set out in Section 5 of the DPA.
4. Change History
- September 13, 2026: Initial publication of this page. Added the map tile provider (previously undocumented), Resend and Twilio; replaced the informal "SMTP email providers" description; named the hosting provider category and region.