Topout Tech, LLC — Subprocessors
| Document | subprocessors |
| Version | 2026-10-05.1 |
| Effective date | October 5, 2026 |
What this means (plain English)
- These are the outside companies that help us run Topout and that may touch personal data in the process. The list is short and each vendor has one job.
- All are established US cloud providers, engaged under contracts that limit what they can do with data.
- Our AI provider reads only what someone submits to a specific AI feature, such as a résumé, a spec book or a subcontractor's letter. Its commercial terms do not allow it to train its models on what we send.
- Our error-monitoring provider receives a technical report when something in the apps breaks, so we can fix it. Email addresses, sign-in cookies and access links are removed from each report before it is sent.
- Procore is not on the list because it isn't our vendor: it's your system, which we read from only when you tell us to.
- When we add or replace a subprocessor, we update this page, and customers with a signed data-processing agreement get direct notice.
This page lists the third-party subprocessors Topout Tech, LLC uses to provide the Service, the function each performs, and the data each processes. This list was built from the platform's actual code and infrastructure (last verified 2026-10-05).
| Subprocessor | Function | Personal data processed | Location |
|---|---|---|---|
| Clerk, Inc. | Identity and passwordless sign-in for all apps | Names, email addresses, sign-in events and session metadata | United States |
| Supabase, Inc. | Database and file storage (single platform database) | All Customer Data: firms, memberships, projects, evaluations, closeout records, uploaded documents, contact records | United States — AWS us-east-1, N. Virginia (verified 2026-07-22) |
| Vercel, Inc. | Application hosting, serverless compute, scheduled jobs; cookieless aggregate analytics for the marketing site | All Service traffic in transit; request logs including IP addresses; anonymous, aggregate page-view statistics (no cookies or persistent identifiers) | United States |
| Resend, Inc. | Transactional email (invites, reminders, demo links) | Recipient names and email addresses; firm/project names appearing in message content | United States |
| PostHog Inc. | Product analytics and session replay inside the apps, used to see where the product is confusing or broken | Pages visited, clicks and other interactions, device/browser/screen information, account identifier and email address, firm identifier; session replays in which all typed input is masked in the browser before it is sent. Cookieless: nothing is written to browser storage | United States (US cloud) |
| Functional Software, Inc. (Sentry) | Error monitoring for the apps: when something breaks, a report of the error is sent so we can find and fix it | Error messages and code stack traces, the page or request address, browser and device type, and the app version. Configured to send no cookies, request headers or account details; email addresses and access links are removed before a report is sent; session replay is off | United States |
| Anthropic, PBC | AI processing for specific features: reading a résumé submitted to Topout Talent and splitting a bulk résumé upload into individual résumés; importing a firm's branding from its public website; drafting closeout requirements from specification documents (Closeout Compass); comparing a subcontractor's submitted letter with the wording the contractor issued (Closeout Compass); and answering a visitor's question in a product demo. Each feature sends only the content submitted to it. Anthropic's commercial terms do not permit it to train its models on content we send | Whatever the submitted content contains: for a résumé, the candidate's name, contact details, work history and qualifications; for specification documents and letters, the names and contact details of project participants; a demo visitor's typed question | United States |
Related services that are not subprocessors:
- Procore — a customer-directed integration. When a customer runs a Procore import, Topout reads the customer's own Procore records at the customer's instruction. Procore is the customer's vendor, not ours; no Procore credentials are stored by Topout.
- Porkbun LLC — domain registrar and DNS for topout.build. Resolves domain names only; processes no customer or user data.
- GitHub, Inc. — source-code hosting for Topout's own code; no customer data.
Change notice. We will update this page before adding or replacing a subprocessor. Customers with a signed Data Processing Agreement receive notice per that agreement (30 days) and may object as provided there.
Questions: privacy@topout.build.