Proof — Subprocessor List
Last Updated: July 11, 2026
This Subprocessor List identifies the third-party subprocessors that Proof Incorporated ("Proof") engages to Process Personal Data on behalf of its customers ("Customer Personal Data") in connection with the Proof service at goproof.ca. It is incorporated by reference into, and forms part of, the Proof Data Processing Addendum ("DPA"). Capitalized terms used but not defined here have the meanings given in the DPA.
By accepting the DPA, the Customer authorizes Proof to engage the Subprocessors listed below. Proof imposes on each Subprocessor, by written contract, data-protection obligations substantially equivalent to those in the DPA, and remains responsible for each Subprocessor's Processing of Customer Personal Data as set out in Section 5 (Subprocessors) of the DPA. Proof will provide notice of any intended addition or replacement of a Subprocessor, and the Customer may object, in accordance with Section 5 of the DPA.
Current Subprocessors
| Subprocessor | Purpose | Data processed | Primary location |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Primary application database (Postgres), authentication (Auth / GoTrue), and file storage for the Service. | All Customer Data at rest, including account and dashboard-user records (name, email, salted password hash, MFA data), the append-only event/ledger records, GPS coordinates, shipment and contact records, and scan photographs (private storage bucket). | Canada — hosted in the ca-central-1 region. |
| Vercel (Vercel Inc.) | Application hosting, serverless functions, edge network, and content delivery (CDN) for the Service. | Request and connection data transiting the application, including IP addresses, request metadata, and any Customer Personal Data contained in requests and responses in transit; data is not retained by Vercel as a primary store. | United States / global edge network. |
| Resend (Resend, Inc.) | Delivery of transactional email sent on the Customer's behalf (update documents, work orders, day tickets, action/wait-loop and handoff links, with PDF attachments). | Recipient name and email address, email subject and message content, attachments, and delivery status/metadata. | United States. |
| Twilio (Twilio Inc.) | Delivery of transactional SMS sent on the Customer's behalf (arriving-soon alerts, hold/release wait-loop texts, badge and handoff links, work-order and relay notifications). | Recipient cell phone number, message content, and delivery status/metadata. | United States / global carrier network. |
| Anthropic (Anthropic PBC) | AI (Claude Haiku) that extracts an estimated time of arrival from Customer-pasted third-party tracking-page text, and screens free-text driver notes for Customer-blocked content before they are sent. The AI reads only the specific text submitted for the task; it has no access to the Proof database, and deterministic code makes every decision and writes every record. | Only the specific text submitted for each task — pasted tracking-page text and individual free-text driver notes — together with the model's structured output (e.g., extracted timestamp and confidence, or a screening result). No account records, ledger, photographs, or database contents. | United States. |
Notes
- Payment processing is not currently engaged. Proof does not use a payment processor and does not process or store cardholder or bank data through the Service; customer billing is tracked manually by the Proof founder. No payment-processing Subprocessor is engaged at this time. This list will be updated if that changes.
- Proof-affiliate and infrastructure providers. The Subprocessors above may in turn rely on their own infrastructure providers (for example, cloud hosting used by a Subprocessor). Proof's contracts require each Subprocessor to remain responsible for such downstream providers.
- International transfers. Where a Subprocessor Processes Customer Personal Data outside the exporting jurisdiction, such transfers are subject to appropriate safeguards as described in Section 8 (International Transfers) of the DPA.
- Changes. This list is maintained and updated as the Service evolves. The "Last Updated" date above reflects the most recent change. Additions and replacements are handled in accordance with Section 5 (Subprocessors) of the DPA.
This Subprocessor List is provided by Proof Incorporated in respect of the Proof service at goproof.ca. Questions may be directed to support@goproof.ca. It should be reviewed by qualified legal counsel before use and completed by replacing each bracketed placeholder token.