About this list
- Sub-processors are services CCS engages to run client applications — CCS remains responsible for them under the MSA and DPA. Before a new one touches your personal data, we email you and you have 30 days to object (DPA Section 4.3).
- Client-connected services are accounts you connect yourself (your accounting, fleet, or email provider) — your agreement with that provider governs them (MSA Section 6.3).
- Not every provider applies to every application. Your SOW and your application's features determine which ones touch your data.
- Providers process data in the United States unless noted; globally operated providers are marked.
Sub-processors — infrastructure & hosting
| Provider | What it does | Location |
|---|
| Vercel Inc. | Web application hosting and content delivery | United States (global CDN for cached public assets) |
| Supabase Inc. | Database, authentication, and file storage | United States |
| Amazon Web Services, Inc. | Underlying cloud infrastructure for Supabase-hosted databases and storage | United States |
| Railway Corp. | Application hosting (select applications) | United States |
| Google LLC | Cloud services and integrations provided by CCS (e.g., maps, routing) | Primarily United States; Google operates globally |
| Microsoft Corporation | Sign-in and Microsoft 365 / Teams integration where provided by CCS | Primarily United States; Microsoft operates globally |
Sub-processors — AI services
Used to power AI-assisted features identified in your SOW. Our agreements with these providers prohibit them from using client data to train their models, and we use zero- or limited-retention configurations where offered (DPA Section 2.5).
| Provider | What it does | Location |
|---|
| Anthropic PBC | AI features (Claude models) | United States |
| OpenAI, L.L.C. | AI features (select applications) | United States |
Sub-processors — communications
| Provider | What it does | Location |
|---|
| Twilio Inc. | SMS notifications (select applications) | United States |
| Trimble Inc. (PC Miler) | Commercial routing and mileage (select applications) | United States |
| SerpApi, LLC | Travel and search data for route planning (select applications) | United States |
Client-connected services
These connect to your application through your own accounts, under your own agreements with the provider (MSA Section 6.3). They are not CCS Sub-processors. Common examples for CCS-built applications:
| Provider | Typical use |
|---|
| Intuit Inc. (QuickBooks) | Accounting integration using the client's QuickBooks account |
| Motive Technologies, Inc. | Fleet / ELD integration using the client's Motive account |
| Google LLC / Microsoft Corporation | Sign-in, email, or calendar through the client's own workspace tenant |
CCS's own business providers
CCS also uses providers for its own operations (for example, Recall.ai for sales-call transcription with participant consent). These handle CCS's business information, not the data inside client applications, and are covered by our Privacy Policy rather than by clients' DPA objection rights.
Changes to this list
When a new Sub-processor will process client personal information, we update this page and email affected clients, who may object within 30 days (DPA Section 4.3). A change in a listed provider's name or controlling entity is notified the same way. Removals are recorded in the changelog below. Questions: cmcelven@creamcity-solutions.com.
Changelog
| Date | Change |
|---|
| October 5, 2026 | v1.1 — Restructured into Sub-processors / client-connected services / CCS business providers; added Amazon Web Services (underlying infrastructure for Supabase); moved Intuit and Motive to client-connected services; moved Recall.ai to CCS business providers. |
| October 5, 2026 | v1.0 — Initial published list. |