Sub-processors

Order3 is available today. This page lists the categories of sub-processors we use today to operate the marketing site, the product, and our support and sales workflows. We are deliberately not naming specific vendors on the public site yet, because the stack is still being narrowed and we want to avoid publishing a list we will revise weekly. Named vendors and a formal change-notification process will be published here when we publish final terms. Active workspaces and customers under a signed DPA can request the current named list at any time by emailing dpa@order3.com.

Sub-processors in this category run our application servers, managed databases, object storage, content delivery network, and DNS. They process customer data only as needed to deliver the service and are bound by written agreements covering security, confidentiality, and sub-processing. Hosting is concentrated in a small number of providers operating in regions documented in our DPA. We avoid co-locating customer data across regions unnecessarily and disclose data-residency arrangements on request.

Sub-processors in this category measure traffic, conversion, and product-funnel events on the marketing site and inside the product. We use analytics that respect Do Not Track and similar signals where supported, and we configure providers to minimize personal-data collection (for example, IP truncation where available). We do not sell analytics data, and we do not use marketing-site analytics to identify individual visitors outside what they submit through our forms.

Sub-processors in this category capture application errors, performance traces, and operational logs from the product and supporting services. They may incidentally process limited personal data, for example, the user identifier associated with an error, to help us diagnose issues. Access is limited to engineers who need it to operate the service, scrubbing rules are applied to known-sensitive fields, and retention is set to the minimum useful window.

Sub-processors in this category send operational email such as account confirmations, password resets, alert notifications, support replies, and incident communications. They process recipient email addresses and message bodies, and are bound by agreements that prohibit using that data for their own purposes. Marketing email, when separately enabled, runs through the same or related providers and includes an unsubscribe path on every message.

Sub-processors in this category handle help-desk tickets, sales conversations, and the customer-relationship records that follow them. They process the contact information and message content you share with us through forms, email, and demos. Access on the Order3 side is limited to support, sales, and operations roles. As the product matures we will publish the specific tools used in this category and a change-notification mechanism so customers can object to additions where required by their DPA.