Subprocessors
Last updated August 24, 2026
A subprocessor is a company we use that may handle customer data in the course of running SOAR. This is the complete list. It is the same list referenced by the Data Processing Addendum and the Privacy Notice.
Always in use
These handle data for every customer.
| Subprocessor | What it does | Data it can see | Location |
|---|---|---|---|
| DigitalOcean, LLC | Hosts the SOAR API, the database and the licence server | All workspace data at rest | New York, United States |
| Anthropic, PBC | Runs the AI models behind triage, drafting, expense coding and the assistants | Whatever a given automation needs: message text, record fields, statement rows, uploaded spreadsheet contents | United States |
| Resend (Plus Five Five, Inc.) | Sends product email — invitations, password resets, notifications, invoice delivery | Recipient address, sender name, message content | United States |
| Cloudflare, Inc. | DNS and network protection in front of the API | Connection metadata; traffic in transit | Global |
| GitHub, Inc. | Serves the marketing website and the account-setup pages | Web request logs only. No workspace data | Global |
Used only if you turn them on
| Subprocessor | What it does | Data it can see | Location |
|---|---|---|---|
| Plaid Inc. | Bank and card transaction feeds | Account and transaction data for the accounts you link | United States |
| Microsoft Corporation | Mailbox and calendar access, if you connect a Microsoft account | The mailbox you authorise | Global |
| Google LLC | Mailbox access, if you connect a Gmail account | The mailbox you authorise | Global |
Microsoft and Google are listed for completeness. When you connect your own mailbox you are using your own account with your own provider under your own agreement with them — we are reaching into a system you already have, not handing your data to a new company.
The AI vendor question, answered directly
Anthropic is the only AI provider that receives customer data. People ask, so: we do not send your data to OpenAI, to Google Gemini, or to any other model vendor.
The AI router in our codebase contains fallback entries for other providers. They are inert — they are skipped unless an API key is configured, and no key is configured. If that ever changes, this page changes first, and every customer on a signed DPA is notified before the change takes effect.
Under our commercial terms with Anthropic, content sent through their API is not used to train their models.
Changes to this list
We will give at least 30 days' notice before adding a subprocessor that will handle customer personal data. Notice goes to the address on your account and to this page.
If you have a signed DPA and you object to a new subprocessor on reasonable data-protection grounds, tell us within those 30 days. We will try to offer a way round it, and if we cannot, you may terminate the affected part of the service without penalty.
To be told about changes, email hello@soar-crm.com and ask to be added to the subprocessor notice list.
Contact
SOAR CRM LLC 100 Holly Park Court, Holly Springs, GA 30115 hello@soar-crm.com