Subprocessor Disclosure Statement
Effective date: December 2025
Last updated: December 10, 2025
Overview
Solutioneers Inc. uses a limited number of carefully selected third-party service providers ("subprocessors") to support delivery of the StackIQ platform and related integration services. Each subprocessor is evaluated through our Vendor Management Policy and bound by written agreements that require security, confidentiality, and privacy safeguards consistent with SOC 2 and ISO 27001 requirements.
Solutioneers remains responsible for the security and confidentiality of all customer data processed by these subprocessors. We review this list annually and whenever material changes occur. Customers will be notified of material updates at least 30 days before they take effect.
Current Subprocessors
| Subprocessor | Purpose | Data Processed | Data Location | Certifications |
|---|---|---|---|---|
| Supabase | Database hosting, authentication, serverless functions | Customer and application data | USA (East & West regions) | SOC 2 Type II, ISO 27001 |
| Amazon Web Services (AWS) | Infrastructure hosting and encrypted backups | Encrypted data, logs | USA (Virginia / Oregon) | SOC 2 Type II, ISO 27001 |
| Vercel / Netlify | Front-end application hosting | Non-sensitive metadata | USA | SOC 2 Type II |
| Merge.dev | API integration layer for HRIS, ERP, and SSO systems | Integration metadata | USA | SOC 2 Type II |
| Sprinto | Compliance automation and evidence management | Compliance documentation | USA | SOC 2 Type II, ISO 27001 |
| Checkr / Rippling | Employee background checks and HR administration | Employee and HR data | USA | SOC 2 Type II, ISO 27001 |
Data Protection and Oversight
All subprocessors operate under contractual terms that:
- Require adherence to Solutioneers' Information Security Policy and confidentiality obligations.
- Mandate encryption of data in transit and at rest (TLS 1.2+, AES-256).
- Require timely incident reporting in accordance with our Incident Response Policy.
- Limit processing to the scope required for service delivery.
Contact
Questions or requests regarding subprocessors may be directed to: