SERVICE PROVIDERS & SUBPROCESSORS
Who helps us provide FSS ONE
A transparent register of core infrastructure providers and customer-directed connected platforms. A listed conditional provider receives data only when the relevant feature or deployment is used.
Roles matter
Not every company below is a subprocessor in every context. Google, Microsoft and other mailbox providers are usually customer-selected connected platforms and may act under their own terms. Infrastructure providers process data on our behalf for the stated service. The exact list for an enterprise deployment depends on its enabled providers, hosting region and contract.
Current register
Google LLC and Google Ireland Limited
Only for customers that connect Google.- Service
- Google Identity, Gmail and Google Workspace
- Purpose
- Customer-directed authentication and mailbox transport or synchronisation when a user connects Google.
- Data involved
- Account and mailbox identifiers, OAuth grants, messages, threads, attachments and delivery data required by enabled features.
- Processing locations
- United States, EEA and other Google processing locations.
Microsoft Corporation and Microsoft Ireland Operations Limited
Only for customers that connect Microsoft.- Service
- Microsoft identity platform, Outlook and Microsoft 365
- Purpose
- Customer-directed authentication and mailbox transport or synchronisation when a user connects Microsoft.
- Data involved
- Account, tenant and mailbox identifiers, OAuth grants, messages, attachments and delivery data required by enabled features.
- Processing locations
- United States, EEA and other Microsoft processing locations.
Customer-selected SMTP/IMAP provider
Only for customers that configure that provider.- Service
- Business email transport and mailbox synchronisation
- Purpose
- Customer-directed sending and incoming-mail access when the customer configures a supported provider other than Google or Microsoft.
- Data involved
- Mailbox address, server settings, protected credential references, messages, attachments, replies and delivery data required by enabled features.
- Processing locations
- Locations chosen by the customer and used by the selected mailbox provider.
Supabase, Inc.
Applies to deployments configured to use Supabase services.- Service
- Managed database and object storage
- Purpose
- Application data storage, workspace separation, operational records and protected file storage for deployments using Supabase.
- Data involved
- Customer account, workspace, mailbox, campaign, message, reply, audit and file data configured for the deployment.
- Processing locations
- The region configured for the relevant deployment and limited support locations.
OpenAI group entity and its hosting infrastructure providers
Applies to public-site visitors; embedding processing only when a separate workflow is approved.- Service
- Sites deployment and hosting; OpenAI API embeddings where separately approved
- Purpose
- Publish and protect the public FSS ONE site and email-preference interface; separately, create numerical embeddings from a sanitised semantic corpus.
- Data involved
- Public site content, IP address, browser or device information, essential request logs and unsubscribe token requests; separately, sanitised semantic corpus text. This entry does not state that customer mailboxes or recipient lists are submitted to the OpenAI API.
- Processing locations
- United States, EEA and other service delivery locations.
Not currently active
FSS ONE does not currently provide a Facebook, Instagram or WhatsApp connector and does not receive Meta user data. The current mailbox workflow also does not submit mailbox or recipient content to an external generative-AI model. Any future activation that changes these facts will require an updated privacy notice and provider register before processing begins.
Safeguards and changes
We assess providers in proportion to the data and risk, limit access to the contracted purpose, and use contractual and transfer safeguards where applicable. Customer credentials are not given to a provider merely because it appears on this page. A listing does not by itself state that a particular customer DPA, transfer assessment, standard contractual clauses or certification has been executed.
We will update this register before a new provider begins materially different processing. Enterprise customers may request the list relevant to their deployment and advance change notice through their contract. Questions or objections may be sent to vladimir@fevralov.com.