CRMish

Sub-processor List

Last updated: 2026-05-28 · DRAFT v4 — counsel review required

> Not legal advice. Working draft of the sub-processors that may process customer personal data on our behalf. Read alongside the Privacy Policy and Data Processing Addendum.

1. About this list

CRMish (operated by JAS Operations LLC dba CRMish) engages third-party providers ("sub-processors") to deliver parts of the Service. Each sub-processor is bound by contract to process customer data only on our documented instructions and only for the purposes listed below.

We update this list at least 30 days before adding or replacing a sub-processor that processes personal data, unless an emergency security or service-continuity issue requires faster action. Customers with an executed Data Processing Addendum may subscribe to change notifications at privacy@crmish.io.

2. Current sub-processors

Infrastructure and hosting

| Provider | Purpose | Data categories | Location | |---|---|---|---| | Vercel | Web hosting, edge delivery, server-functions runtime, environment-variable storage | All customer data passes through Vercel infrastructure | United States (primary), global edge | | Turso (libSQL) | Primary database — stores all workspace data, account info, webhook events, push subscriptions, billing references | Account info, workspace content, audit logs | United States |

Payments

| Provider | Purpose | Data categories | Location | |---|---|---|---| | Stripe | Payment processing, subscription management, tax calculation, fraud detection | Name, email, billing address, payment method (Stripe collects directly) | United States, EU |

Communications

| Provider | Purpose | Data categories | Location | |---|---|---|---| | Resend | Transactional email — password resets, invites, billing receipts, sprint nudges, daily drop | Email address, message contents | United States | | Mozilla / Google / Apple push services | Web push notification delivery via the Web Push API (per-browser) | Push subscription endpoint, notification payload | Global |

AI processing

| Provider | Purpose | Data categories | Location | |---|---|---|---| | Anthropic | AI Coaching feature — generates personalized coaching responses based on user-submitted prospect context (Pro tier feature, on user interaction) | Structured prompts (engagement scores, conversation excerpts, prospect notes) | United States |

Security

| Provider | Purpose | Data categories | Location | |---|---|---|---| | Cloudflare | Turnstile bot-protection challenge on sign-up and sign-in surfaces | IP address, browser metadata, challenge response | Global |

Internal tooling (no customer-data processing)

| Provider | Purpose | Data categories | Location | |---|---|---|---| | GitHub | Source-code hosting | None — no customer data | United States | | 1Password | Internal credential storage | None — no customer data | Canada | | Northwest Registered Agent | Registered agent for JAS Operations LLC dba CRMish | None — entity records only | United States |

3. International transfers

Most sub-processors are based in the United States. Where the GDPR / UK GDPR applies, transfers are governed by the Standard Contractual Clauses (SCCs) included in each sub-processor's data-processing terms, supplemented by transfer-impact assessment where required.

4. Sub-processor selection

We select sub-processors based on:

  • Their published security and privacy practices.
  • Their willingness to enter into a data-processing addendum incorporating SCCs.
  • Their compliance certifications (SOC 2, ISO 27001) where applicable.
  • Operational fit for the purpose.

5. Change notification

We will notify Data Processing Addendum signatories at least 30 days before:

  • Adding a new sub-processor that will process customer personal data.
  • Replacing a current sub-processor with a different provider.

Notification will be sent to the email on file. Customers who object to a new sub-processor may terminate the affected service per the DPA.

6. Removed sub-processors

| Provider | Removed on | Reason | Replaced by | |---|---|---|---| | (none yet) | | | |

7. Contact

Questions about this list: privacy@crmish.io.

Document version: subprocessors-v1 · Last updated 2026-05-28.