Skip to content
Start free
Legal

Sub-processors

The outside companies that process customer data for Upways, what each one does, what it gets, and where.

Last updated October 8, 2026 · Version 2026-10-083 minute readralpasovsi@gmail.com
On this page 4 sections

How this list works.

A sub-processor is a company we use to run part of Upways that may handle personal data our customers put into it. Each one is bound by a contract to use the data only for the job we give it and to keep it secure. We add a company to this list before it receives any customer data, and business customers who ask are told at least 30 days before a new one starts, with the chance to object (see the Data processing addendum).

Always in use.

These run the service for every customer.

  • Supabase: Database, sign in and file storage. Data: Everything stored in Upways: accounts, company records, rescues, loads, documents, photos, messages. Where: United States.
  • Vercel: Hosting the website, the dashboard and the server, and scheduled jobs. Data: Every request passes through; short lived request logs. Where: United States, with a global edge network.
  • Google (Maps Platform): Maps, place search, addresses and routes. Data: Map positions and the addresses or places searched. Where: United States.
  • Anthropic: AI features: reading papers and emails, suggestions, Uppy. Data: The page, email or words being read, only when a feature is used. Not used to train models. Where: United States.
  • Resend: Sending email (codes, notices, invoices, reminders). Data: Recipient address and the email. Where: United States.
  • Stripe: Subscriptions and payments. Data: Billing name, email, address and card (cards stay at Stripe). Where: United States.
  • Expo: Push notifications and app updates. Data: Push token and the text of each notification; for update checks, the app version, platform, an install id and the network address. Where: United States.
  • Apple: iPhone push notifications and Live Activities; on an iPhone, the built in map, address lookups and speech to text. Data: Device token and notification text; map areas, positions or addresses looked up; a voice recording when the microphone button is used, if the device sends it to Apple. Where: United States.
  • Google (Android and Chrome): On Android, address lookups; on Android and in Chrome, speech to text. Data: Positions or addresses looked up; a voice recording when the microphone button is used, if the device sends it to Google. Where: United States.
  • Google (Firebase Cloud Messaging): Android push notifications. Data: Device token and notification text. Where: United States.

Only when a company turns them on.

These receive data only if a company uses the feature or connects its own account.

  • Twilio: Calls through an Upways phone number. Only for companies that turn calling on. Data: The phone numbers, call times and length; recordings only if the company turns them on. Where: United States.
  • Sentry: Crash and error reports. Only while crash reporting is switched on. Data: Scrubbed error reports with an account id and role; no names, emails, phones, links or positions. Where: United States.
  • Google (Gmail) or Microsoft (Outlook): Reading, and if allowed sending, the inbox a company connects. Only when an owner connects an inbox. Data: That mailbox's emails and attachments. Where: United States.
  • Motive, Samsara or Geotab: Truck positions and hours from the company's ELD. Only when an owner connects one. Data: That company's truck positions and hours of service (sent to us by them). Where: United States.
  • Intuit (QuickBooks Online): Sending invoices and costs to the company's books. Only when an owner connects QuickBooks. Data: Invoices, customers, costs. Where: United States.
  • TollGuru and PC*MILER: Toll and mileage estimates. Only when switched on. Data: Route points (no names). Where: United States.

Public lookups and website resources.

These receive no customer personal data, only a public number, a web address or a visitor's network address.

  • FMCSA: carrier records by USDOT or MC number.
  • NHTSA: decoding a truck's VIN.
  • DuckDuckGo icon service: a broker's logo, by its web address only.
  • Google Fonts: the dashboard's icons, which your browser loads from Google. The website's own type and every printed paper (invoices, statements, reports) are served by Upways.