Subprocessors
The providers Includoc uses to run its service, what each one does, the data it handles, where it processes data, and how we notify you of changes.
Last updated
Not legal advice
Includoc provides evidence of automated and human accessibility checks. It is not legal advice and does not certify legal compliance.
A subprocessor is a company we use that may process customer data, including personal information in the documents you upload. This page lists our current subprocessors, what each one does for us, the data it handles and where it processes that data. Our Data Processing Addendum explains our commitments about subprocessors.
Current subprocessors
| Provider | What it does for us | Data it handles | Where |
|---|---|---|---|
| Vercel | Hosts our website and the web app's pages | IP addresses and request logs. It doesn't receive your documents, which upload directly to our storage | United States; public pages are delivered through Vercel's global network |
| Convex | Our backend: database, server functions, job queue and secret store | Account information, check and fix results, reports and audit logs; document text, structure and page images while they're being processed | United States |
| Cloudflare | File storage (R2), document processing containers, our crawler, bot protection (Turnstile) and DNS | Uploaded documents, fixed files, page images and reports; IP addresses and browser signals for bot checks | United States for storage and processing; DNS and bot protection run on Cloudflare's global network |
| OpenRouter | Routes AI requests to our model provider, with zero data retention and no training | Page images, cropped figures, and text and structure information from documents being fixed; images submitted to the alt-text generator | United States |
| Anthropic | AI model provider (Claude models), reached through OpenRouter | The same data as OpenRouter | United States |
| Stripe | Payments, subscriptions, invoices and sales tax | Billing contacts, payment details, invoices and tax-exemption certificates | United States |
| Resend | Sends email, including sign-in links, notifications, reports and newsletters you opt into | Email addresses, names and email content | United States |
| Sentry | Error monitoring | Technical error details, which can include IP addresses, browser information and user IDs | United States |
| PostHog | Product analytics, with session replay turned off | Pseudonymous usage events, IP addresses and browser information | United States |
| Better Stack | Uptime monitoring, status page and service logs | Service logs, which can include IP addresses and user IDs; email addresses of status page subscribers | United States |
Planned subprocessors
We'll add these to the list above, and give notice as described below, before they process any customer data:
- WorkOS, for single sign-on (SAML and OIDC) on Organization Plus, once that feature launches.
Human-verified specialists
If you order human verification, the accessibility specialist who reviews your document may be an independent contractor rather than an employee. Specialists work under written confidentiality obligations and see only the files assigned to them.
Business tools
We also use everyday business tools for company email, scheduling calls, customer support and bookkeeping. They may hold your contact details and the messages you send us. They aren't used to process the documents you upload to Includoc.
How we tell you about changes
- Advance notice. Before a new subprocessor starts processing customer data, we update this page and email the owners of organization accounts at least 30 days in advance.
- Objections. Customers can object to a new subprocessor as described in section 7 of our Data Processing Addendum.
- Urgent replacements. If we have to replace a provider quickly, for example because of an outage or a security problem, we'll notify you as soon as we can.
- Updates by email. To get these notices even if you're not an organization owner, email support@includoc.com with "Subprocessor updates" in the subject line.
Related
- Data Processing Addendum
How Includoc processes personal data for customers: roles, instructions, security, subprocessors, breach notice, deletion, audits and data transfers.
- Privacy Policy
What personal information Includoc collects, why we collect it, how long we keep it, who processes it for us, and the choices and rights you have.
- Trust and security
How Includoc stores, protects and deletes your documents: US storage, encryption, short retention, isolated processing and no AI training on your files.