1. Current subprocessors
| Subprocessor | Purpose | Data category | Location |
|---|---|---|---|
| Stripe | Payment processing | Payment tokens, billing contact information | Canada / United States |
| Stripe Identity | Identity verification (IDV) | Government ID, selfie (biometric comparison), verification result | Canada / United States |
| Plaid | Bank account linking for pre-approval | Bank account tokens, limited account details | Canada / United States |
| Inovatec (Propel) | Credit pre-approval routing to lenders | Credit application data, pre-approval results | Canada |
| Twilio | SMS verification and account messaging | Phone number, message content | United States |
| PostHog | Product analytics (used only inside the dealer credit-application widget, cookieless) | Anonymous session identifier, product usage events | United States / European Union |
| Sentry | Error monitoring, with PII scrubbed before events are sent | Application error data, scrubbed of personal information | United States |
| Cloudflare | Security, bot protection (Turnstile), content delivery, and object storage | Network/request metadata, uploaded files (photos, documents) | Global (Cloudflare network) |
| Vercel | Application hosting | All data in transit through the application | United States |
| Neon | Database hosting | All data stored in Frank’s primary database | United States |
2. How we choose subprocessors
Before we engage a new subprocessor, we review its security practices, its own subprocessing chain, and where it stores and processes data. We contractually require each subprocessor to protect data to a standard consistent with our own obligations under our Privacy Policy and Data Processing Addendum.
3. How this list relates to our other documents
This list is referenced by our Privacy Policy (sharing your information) and our Data Processing Addendum §8. If you are a dealer or business customer reviewing Frank as a vendor, this page is the current, standalone reference — no need to request it separately.
4. Changes to this list
We may add or remove subprocessors as our platform evolves. Material changes will be posted here with an updated date. Dealer customers with a signed agreement that requires advance notice of a new subprocessor should contact privacy@drivefrank.ca or call 647-360-8580 to confirm the notice period and objection process that applies to them.