← Back to home
Subprocessors
Effective date: June 16, 2026
CivicRecordsOnline uses a limited set of subprocessors to host, deliver, secure, monitor, and bill the service. Customer records data is used only to provide CivicRecordsOnline and is never used to train external AI models.
Customer Data Subprocessors
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Microsoft Azure | Application hosting, database, file storage, secrets management, logging, and monitoring. | Agency account data, requester records, request documents, audit logs, staff account metadata, application logs. | United States |
| Twilio SendGrid | Transactional email delivery and email delivery event webhooks. | Email addresses, message metadata, email body content needed to deliver notices, bounce and delivery events. | United States |
| Stripe | Subscription checkout, billing portal, invoices, and subscription payment-status webhooks. | Billing contact details, customer IDs, subscription and invoice metadata, payment status metadata. CivicRecordsOnline does not store card numbers. | United States |
| Cloudflare | DNS, edge routing, security controls, and request metadata used to protect public domains and tenant portals. | Request metadata such as hostnames, IP addresses, timestamps, and security events. | Global network, with logs and account data governed by Cloudflare's service terms. |
Marketing Website Analytics
The public marketing website uses Google Analytics 4 to understand site traffic. Google Analytics is used for marketing-site analytics only and is not used to process agency records, request documents, requester submissions, or staff workspace content.
Changes
We will update this page before adding a new subprocessor that processes customer data in a materially different way. For procurement or security review questions, email security@civicrecordsonline.com.