Sub-processors

How this list is organised

The code reaches outside vendors in four different ways, and the legal answer may differ for each. So the list is split four ways:

• A. Platform sub-processors. AquaCRM engages these itself, on its own account, for every customer. Most of them handle every customer's data. A few are reached only through particular features, but those features use AquaCRM's own account with the vendor, not the customer's.
• B. Connected Services. The customer connects these with its own account and credentials, and AquaCRM's code calls them on the customer's instruction. The draft DPA (clause 7.4) proposes that they are the customer's own processors, not AquaCRM's sub-processors. That is a proposal for the solicitor, not a settled position.
• C. Planned, not active. The backup system will use these once it is switched on.
• D. Not sub-processors, said out loud, so a reviewer does not think they were missed.

Why category B can be separated from A. For most providers, the code uses the deployment's own keys only for the operator's own agency. For every other agency, a feature that needs the provider does not work until the agency connects its own account. Three providers are exceptions. Some of their code paths use the deployment's own account for any agency, so they appear in table A for those uses and in table B for the rest:

• Resend, for the verification email sent when a new agency signs up;
• GitHub, for publishing a client project and for the code editor, wherever the agency has not connected its own GitHub account;
• Vercel, for client-project preview deployments, wherever the agency has not connected its own Vercel account.

See reviewer note 3.

---

A. Platform sub-processors

B. Connected Services (the customer's own accounts)

The customer creates the account with each of these providers and gives AquaCRM the credential. AquaCRM stores the credential encrypted when it is entered through the integration, calendar or inbox connections, a module's secret settings field, or, from [the date the Email sender change is deployed], the Email sender module's own Settings page. DPA Annex 2 item 4 names the exceptions: a secret typed into an automation's webhook headers or a website-editor webhook target is stored in plain text, and so is every Email sender credential until that date, and one stored before it until it is re-encrypted. AquaCRM sends data to the provider only when the customer uses the feature. The provider's region is whatever the customer's own account is set to. The regions below come from the register and describe the provider's default position. None of them has been verified.

Resend, GitHub and Vercel appear in both tables. Table A covers the paths that use AquaCRM's own account. Table B covers the same provider once the customer connects its own. For GitHub and Vercel, that split is how the code behaves today, not a decision anyone has made. See open question E6.

The operator's own agency. For the operator's own agency only, the deployment's own keys are used where no connection has been made. That covers Resend, Stripe and OpenAI, for example. For that one agency, these providers are the operator's processors. This does not affect customers.

C. Planned — will process data once the backup system is switched on

The off-database backup is built and switched off. Once it is switched on:

[Solicitor: does a vendor that holds only data encrypted with a key it never sees need to be listed as a sub-processor?]

D. Not sub-processors, said out loud

• The malware scanner is AquaCRM's own. Uploaded files are scanned by a ClamAV service that AquaCRM runs itself; the register records it as running in the same Railway project as the application. It reads the uploads sent to it for checking, and it is not a third party. But files do cross the public internet to reach it. The code will not send a file to a private address: it refuses private and unique-local addresses, which is how Railway's private network is addressed [per Railway's own description, not checked here]. So the scanner is reached at its public address. Of the two ways a scanner can be configured, one requires HTTPS in production; the other uses HTTPS only if the configured address does. Which one the live service uses is not recorded. No third party receives the files either way. See reviewer note 7.
• Tools the customer adds to its own websites. The Aqua Tag can load analytics and advertising tools that the customer configures for its sites, such as Google Analytics, Google Tag Manager, PostHog or advertising pixels. Each tool waits for the cookie category the customer assigns to it. By default analytics tools are in "analytics" and advertising pixels in "marketing", so they wait for the visitor's consent. But the customer can put any tool in "necessary", and then it loads before the visitor has made any choice. The Search Console verification tag is "necessary" by default. These tools load in the visitor's browser and send data directly to that vendor, under the customer's own arrangement with it. AquaCRM does not receive what they collect.
• The map in Sales scouting. The prospecting screens embed a Google map. The staff member's browser requests it from Google every time the map is shown. If the customer has connected a Google Maps key, the request carries that key and the prospect's Google place id where one is recorded, or else the prospect business's name and address. If it has not, the request carries the name and address, under no account at all. [Solicitor to classify: Google is probably an independent controller here, but the customer should be told about it.]
• Google's public STUN servers, in hosted meetings. When someone joins a meeting room at /m/..., their browser contacts Google's public STUN servers (stun.l.google.com) to discover its own public IP address, so Google receives that IP address. The call itself is peer to peer, so participants' browsers also learn each other's IP addresses. There is no relay server. [Solicitor to classify: as with the map, Google is probably not AquaCRM's processor here, but participants should be told. See open question S4.]
• Shopify is not used. The e-commerce module contains a Shopify client, but nothing calls it and there is no way to connect it. It is not a sub-processor until it is wired up.

---