Material Subprocessors
Last updated September 3, 2026
Mach 1 Integration, LLC uses a small set of third-party infrastructure and service providers to deliver the platform. Under global data-protection frameworks these providers are “subprocessors”: they may process personal data or platform components on our clients’ behalf.
Every provider on this list is evaluated before we engage it and operates under a data processing agreement with security, encryption, and confidentiality obligations that meet or exceed our own.
Active Subprocessors
| Subprocessor | Entity & location | What it does for the platform | Trust & privacy |
|---|---|---|---|
| Amazon Web Services | Amazon Web Services, Inc. (USA) | Core cloud hosting: compute, networking, tenant databases (RDS), and encrypted object storage for uploaded files and backups. | AWS Compliance |
| Google LLC (USA) | Gemini API model inference for document extraction; Firebase Cloud Messaging for mobile and web notifications; Maps address autocomplete for work-site setup. | Google Cloud Trust Center | |
| OpenAI | OpenAI, LLC (USA) | AI APIs for order-intake document reading, resume extraction, and automated classification. | OpenAI Trust Portal |
| Twilio | Twilio, Inc. (USA) | Transactional SMS: shift reminders, coverage announcements, and recruiter coordination. | Twilio Trust Center |
| GitHub | GitHub, Inc. (USA) | Source code hosting, version control, and CI/CD deployment pipelines. | GitHub Security |
| Slack | Slack Technologies, LLC (USA) | Internal operations monitoring and system-failure alerting. Sensitive customer fields are redacted at the application source before any alert is sent. | Slack Trust |
| Vercel (transitional) | Vercel, Inc. (USA) | Legacy frontend hosting, scheduled for decommissioning. This entry will be removed when migration completes. | Vercel Security |
Not Subprocessors, Disclosed for Clarity
- Customer-directed integrations. Systems our clients connect and control — such as an applicant tracking system (e.g., Bullhorn) — are not Mach 1 subprocessors. The client directs those data flows.
- Non-personal-data services. Our demand forecasting calls a weather service (Open-Meteo) with work-site coordinates only. No personal data is involved.
- First-party services. Document OCR, schedule optimization, and activity tracking run on Mach 1-operated services hosted on the infrastructure above.
How We Handle AI Providers
Order emails and resumes submitted to the platform are processed through the OpenAI and Google Gemini developer APIs under their business terms — not through consumer AI tools. Under those terms, API data is not used to train the providers’ models.
Change Notification
We notify clients of any addition to this list at least thirty (30) days before a new provider handles production workloads, per our standard Master Subscription Agreement.
Questions, security notifications, or a countersigned copy of our Data Protection Addendum: tech@mach1integration.com.