Topout Tech, LLC — Subprocessors
| Document | subprocessors |
| Version | 2026-08-21.1 |
| Effective date | August 21, 2026 |
What this means (plain English)
- These are the outside companies that help us run Topout and that may touch personal data in the process. The list is short and each vendor has one job.
- All are established US cloud providers, engaged under contracts that limit what they can do with data.
- Two entries are listed ahead of use: our AI provider, which becomes active only when the AI spec-scan feature launches, and our product-analytics provider, listed here before the measurement was switched on rather than after.
- Procore is not on the list because it isn't our vendor: it's your system, which we read from only when you tell us to.
- When we add or replace a subprocessor, we update this page, and customers with a signed data-processing agreement get direct notice.
This page lists the third-party subprocessors Topout Tech, LLC uses to provide the Service, the function each performs, and the data each processes. This list was built from the platform's actual code and infrastructure (last verified 2026-07-06).
| Subprocessor | Function | Personal data processed | Location |
|---|---|---|---|
| Clerk, Inc. | Identity and passwordless sign-in for all apps | Names, email addresses, sign-in events and session metadata | United States |
| Supabase, Inc. | Database and file storage (single platform database) | All Customer Data: firms, memberships, projects, evaluations, closeout records, uploaded documents, contact records | United States — AWS us-east-1, N. Virginia (verified 2026-07-22) |
| Vercel, Inc. | Application hosting, serverless compute, scheduled jobs; cookieless aggregate analytics for the marketing site | All Service traffic in transit; request logs including IP addresses; anonymous, aggregate page-view statistics (no cookies or persistent identifiers) | United States |
| Resend, Inc. | Transactional email (invites, reminders, demo links) | Recipient names and email addresses; firm/project names appearing in message content | United States |
| PostHog Inc. | Product analytics and session replay inside the apps, used to see where the product is confusing or broken | Pages visited, clicks and other interactions, device/browser/screen information, account identifier and email address, firm identifier; session replays in which all typed input is masked in the browser before it is sent. Cookieless: nothing is written to browser storage | United States (US cloud) |
| Anthropic, PBC — pending activation | AI processing for the specification-scan feature (activates when that feature launches; the provider configuration that excludes submitted content from model training will be confirmed before activation) | Contents of specification documents a customer submits to the feature | United States |
Related services that are not subprocessors:
- Procore — a customer-directed integration. When a customer runs a Procore import, Topout reads the customer's own Procore records at the customer's instruction. Procore is the customer's vendor, not ours; no Procore credentials are stored by Topout.
- Porkbun LLC — domain registrar and DNS for topout.build. Resolves domain names only; processes no customer or user data.
- GitHub, Inc. — source-code hosting for Topout's own code; no customer data.
Change notice. We will update this page before adding or replacing a subprocessor. Customers with a signed Data Processing Agreement receive notice per that agreement (30 days) and may object as provided there.
Questions: privacy@topout.build.