MapleGather

Sub-Processor List

Last updated

In plain terms: To run MapleGather we rely on a small set of trusted infrastructure vendors — for hosting, sending your email, taking payments, and a few other jobs. This page lists every one of them, what they do, and what data of yours they touch. We keep this list short on purpose, and we keep it honest.

What a “sub-processor” is here

MapleGather (the “Service”) processes personal information about your Organization’s Members on your behalf — you are the business, and we are your service provider (see Privacy Policy and Data Processing Addendum). To deliver the Service, we in turn rely on the third-party vendors below. Under the California Consumer Privacy Act (CCPA/CPRA) these are our sub-processors (also called sub-contractors): each is subject to a data-processing addendum (DPA) whose terms flow down protections for personal information to at least the standard we commit to you.

Self-hosted components are not sub-processors. Our identity and authentication system (Keycloak) runs on our own infrastructure inside our Google Cloud environment. It is not a separate vendor and is not listed as a sub-processor; the Google Cloud line below already covers the infrastructure it runs on.

Scope note. MapleGather is a United-States-market service, CCPA-anchored. We do not offer EU/EEA data residency and do not knowingly serve EU-resident data subjects. The primary data store (Member records, files, production database) is in the United States (Google Cloud region us-central1); however, some sub-processors below operate global infrastructure (edge security, AI inference), and two are incorporated outside the US (uptime monitoring and web analytics — which process only operational or aggregate metadata, never Member personal data). The “Processing region” column states this per vendor. See Privacy Policy for our full scope.

Current sub-processors

Last updated: 2026-07-11.

Sub-processor Service it provides Data it may touch Processing region
Google Cloud Platform (Google LLC) — Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, Cloud KMS, Secret Manager, Cloud Monitoring/Logging Core application hosting, primary production database, file/document storage, encryption-key management, secrets, platform monitoring and logs All Member and Organization data stored or processed by the Service (names, emails, phone, addresses, custom-field values, membership/financial records, uploaded files, audit logs) United States (us-central1)
Neon (Neon, LLC — an affiliate of Databricks, Inc.) Serverless PostgreSQL for our staging/pre-production environment (per-pull-request and per-test ephemeral databases) Test and synthetic data only in normal operation; not the production data store United States
Cloudflare (Cloudflare, Inc.) — Cloudflare for SaaS Edge network: DNS, CDN, DDoS protection, web application firewall (WAF), custom-domain TLS for Organization portals, edge rate-limiting Traffic metadata and in-transit request/response content passing through the edge (IP addresses, request headers, TLS termination for custom domains) United States / global edge network
Stripe (Stripe, LLC) — Stripe Connect Payment processing for Organization subscriptions to MapleGather, and for the Organization’s own memberships/events/donations under the Organization’s own Stripe account Payment-card data is entered directly into Stripe and never touches MapleGather servers (PCI SAQ-A). Stripe holds cardholder data, payer identifiers, and transaction records United States
Postmark (AC PM, LLC — a subsidiary of ActiveCampaign, LLC) Transactional and broadcast email delivery on behalf of Organizations (welcome emails, receipts, renewal reminders, newsletters, event notices) Recipient email addresses, names, and the content of emails the Organization sends or the Service sends on the Organization’s behalf United States
Anthropic (Anthropic, PBC) — Claude API, used only for the Service’s AI-assisted features AI-assisted in-app guidance, AI support-draft generation, and AI migration assistance Prompt content only. Prompts are constructed to exclude raw personal information — the Service sends structural descriptions, not Member names/emails/payment data (see Privacy Policy §AI features). Applies only when an Organization uses AI features United States
Mapbox (Mapbox, Inc.) Geocoding for the Member directory map view and radius search (feature-gated; only when an Organization enables map features) Address strings submitted for geocoding United States
Twilio (Twilio Inc.) — Verify product SMS delivery for multi-factor-authentication codes (and, if an Organization enables it, SMS notifications) Recipient phone numbers and one-time verification codes United States
Sentry (Functional Software, Inc. d/b/a Sentry) Application error monitoring Diagnostic/error data. Configured to avoid capturing personal information in error payloads; may incidentally include identifiers present in a request context United States
UptimeRobot (UptimeRobot s. r. o., Slovakia) External uptime monitoring and public status-page checks Service availability metadata only — no Member personal information Monitors US endpoints; operated from Slovakia (EU)
PagerDuty (PagerDuty, Inc.) On-call incident alerting for our operations team Operational alert metadata only — no Member personal information United States
Plausible (Plausible Insights OÜ) — Plausible Analytics Privacy-friendly, cookie-free web analytics for the public marketing (maplegather.com) and help (help.maplegather.com) websites only Aggregate, non-identifying traffic metadata (page URLs, referrers, UTM tags, country, device type). No cookies, no IP storage, no cross-site tracking, no Member/Organization data United States (US data region)

How we notify you of changes

In plain terms: This page is the current, authoritative list of our sub-processors. When it changes, the “Last updated” date changes. Check back here for the current list.

  • We maintain this page as the authoritative, current list. The “Last updated” date at the top changes whenever the list changes.
  • When we add or replace a sub-processor, we update this page. This published list is our notice of changes — we do not commit to individual advance email notice, an advance-notice waiting period, or an objection/veto right.

← All legal documents