SUBPROCESSOR SCHEDULE
Service-provider register
Updated 16 September 2026
This schedule identifies the service providers currently used to operate QuercusQuote and explains their role.
| Provider | Status | Purpose and processing information |
|---|---|---|
| OpenAI Sites platform and infrastructure providers | Active for the marketing website | Marketing-site hosting and operational logs. The paid production application and customer workspaces are not hosted on this platform. |
| Cloudflare | Active production application provider | Workers application hosting, D1 database, R2 object storage, Images, edge services and operational logs. Primary D1 and R2 resources use the configured EU jurisdiction where supported; edge and operational processing may occur internationally. |
| Auth0 by Okta | Active for production and pre-production identity | Authentication, account recovery and multi-factor authentication under the provider’s regional and international-transfer arrangements. |
| Stripe / Link | Active live billing provider | Subscription checkout, billing records, fraud controls and merchant-of-record services where available. The seller and applicable terms are identified during checkout. |
| Microsoft 365 / Outlook | Active business-email provider | Support, privacy and service email under Microsoft’s contractual, regional and international-transfer arrangements. |
| Resend | Active transactional-email provider | Trial welcome, reminder, expiry, deletion-warning and subscription emails, recipient addresses and delivery metadata. The EU sending region is configured and open/click tracking is disabled; delivery infrastructure may involve international processing under the provider’s terms. |
Changes
Subprocessor additions and replacements will be notified under the DPA before they process Customer Data. Customers, including those using a free trial or invited access, may object on reasonable data-protection grounds through the process in the DPA.
International transfers
Where a provider processes UK personal data without UK adequacy coverage, QuercusQuote uses the applicable UK IDTA, UK Addendum, recognised standard contractual clauses or another lawful mechanism, together with supplementary measures where needed. Contact privacy@quercusquote.app for information about safeguards relevant to a particular provider or processing activity.