AssetShop LLC - Effective 2026
This document lists all third-party sub-processors that may process Customer data on behalf of AssetShop in connection with the AssetShop Supply Chain Operations (SCO) service.
AssetShop notifies Customers in writing at least thirty (30) days prior to engaging any new sub-processor that will process Customer data. Customers may object to any new sub-processor by written notice to AssetShop within the notice window, as set forth in the Data Processing Agreement (DPA).
Infrastructure & Hosting
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Google Cloud Platform (Firebase + Cloud Run) | Application hosting, Firestore database, Cloud Functions runtime, identity (Firebase Auth) | All Customer data | US East (primary) / US West / EU Central |
| Cloudflare | DNS, CDN, WAF, DDoS protection, edge caching | Network metadata, request headers | Global edge network |
| GitHub Actions | CI/CD pipeline (no production Customer data) | Source code, build artifacts | US |
Identity & Access
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Google Workspace | Internal staff identity, productivity (no Customer tenant data) | AssetShop staff PII | US / EU |
| WorkOS (planned) | SAML/SCIM provisioning for Customer SSO | SSO claims, group membership | US |
Observability & Operations
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Sentry | Error tracking, performance monitoring (PII scrubbed at source) | Stack traces, request metadata | US |
| PagerDuty | Incident alerting (no Customer data) | AssetShop on-call contact | US |
| Slack | Internal team comms (incident response coordination) | AssetShop staff comms | US / EU |
Email & Communications
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Postmark (or Resend) | Transactional email (sign-in, alerts, reports) | Recipient email, message body | US |
| Stripe (planned) | Subscription billing | Billing contact, payment metadata | US / EU |
Audit Chain Anchoring
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Base L2 (Ethereum L2) | Public anchor for hash-chained audit log roots | SHA-256 hashes only (no underlying data) | Public chain |
| Coinbase Developer Platform (planned) | Anchor transaction submission | Tx broadcast metadata | US |
AI/ML Providers (Customer-elected, per-tenant)
CORTEX, AssetShop's AI workspace product, ships Q4 2026. Customer elects model provider per tenant. When CORTEX activates for a Customer, the Customer's chosen provider is added to this list with the standard 30-day notice. As of the effective date, no AI provider processes Customer data via SCO.
Potential CORTEX providers (Customer-elected): OpenAI, Anthropic, Google AI, Cohere, Mistral, or others mutually agreed.
Change log
All changes to this Sub-Processor List are notified to Customers via:
- Email to the Customer's designated security contact
- Update to this page (
/policies/sub-processors.html) - Status banner on the AssetShop Trust Center for material additions
Material changes (new categories of data, new geographic regions) are notified with 30 days' notice. Routine changes (e.g., a renamed sub-processor under the same controls) may be notified retroactively in the next quarterly review.
Contact for sub-processor inquiries: AssetShopCo@gmail.com