Subprocessors
Last updated: May 5, 2026
Agreement reference: §11(e) of the Cybernex Auto SaaS Service Agreement v3
What this list covers
We use the third-party services listed below to operate the Cybernex Auto SaaS platform. Each subprocessor below has access to specific categories of Customer Data necessary to deliver its function, and each is bound by its own Data Processing Addendum (DPA) listed in the right column.
This list is updated when we add or remove a subprocessor that processes Customer Data. The most recent change date appears above.
Definitions
"Customer Data" means data submitted by an Operator (or by an Operator's customers acting through the Operator's tenant) into the Cybernex Auto platform — for example, vehicle records, lease agreements, payment events, customer profiles, and uploaded files. "Subprocessor" has the meaning given in §11 of the Cybernex Auto SaaS Service Agreement.
Current subprocessors
| Name | Role | Region | Data Categories | DPA |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage, realtime, edge functions | US-East-1 (AWS, Northern Virginia) | All Customer Data — vehicle records, customer profiles, lease agreements, payment history, expense entries, ticket and toll records, Zelle queue items, audit log entries, uploaded files | View DPA |
| Vercel | Application hosting, edge network, build infrastructure | Global edge network; primary region IAD1 (US-East) | Request metadata (IP, user-agent), application logs, environment variables containing connection strings | View DPA |
| Stripe | Payment processing (SaaS subscription billing + per-tenant Stripe Connect for renter charges) | United States (Stripe, Inc.) | Operator + customer billing email, payment instruments (tokenized — never raw PAN), subscription state, charge history, dispute records | View DPA |
| Resend | Transactional email delivery | United States (primary) | Operator + customer email addresses, message subject + body for all transactional sends (welcome, denial, agreement updates, security disclosures, payment receipts, dunning notices) | View DPA |
| Cloudflare | DNS, CDN, bot protection (Turnstile on /apply), edge cache | Global edge network; CDN PoPs include ORD (Chicago) + IAD (Northern Virginia) | Request metadata (IP, user-agent, ASN), Turnstile challenge tokens, public site response cache | View DPA |
| Optimus Tracker | GPS hardware telemetry (vehicle location data) | United States | Vehicle GPS coordinates, ignition state, speed, heading, device-ID metadata for fleet vehicles | View privacy policy |
| Upstash | Redis cache (rate limiting on /apply, ephemeral session helpers) | AWS us-east-1 | Request rate-limit keys (IP-derived), short-lived session tokens — no long-term Customer Data persisted | View DPA |
Updates and notice
We will update this page before adding a new subprocessor that processes Customer Data, and will notify Operators by email at least 14 days in advance of the change becoming effective. To request the underlying DPA documents or to ask a question about a specific subprocessor's data handling, contact info@cybernexauto.com.
Last reviewed by Cybernex Auto LLC, Chicago, IL — May 5, 2026.