Subprocessors
Last updated October 25, 2026 · The providers Thermal relies on to operate the service.
This is the list behind section 3 of our Privacy page. Each provider processes information only as necessary to provide its service to us and is contractually restricted from using it for its own purposes. Where we have not yet confirmed a data category or a hosting region from our own records, the table says “Not verified” rather than guessing.
For how we protect data, see our Security page.
Providers
| Provider | Purpose | Processing class | Data categories | Region |
|---|---|---|---|---|
| Stripe | Payment processing and billing. | Customer-data processing | Not verified | Not verified |
| Clerk | Account authentication and login. | Customer-data processing | Not verified | Not verified |
| Supabase | Our primary database (Postgres), hosted in the US (us-east-1). | Customer-data processing | The records your organization enters into Thermal | US (us-east-1) |
| Vercel | Application hosting and file storage (Blob) for features like data exports. | Customer-data processing | Not verified | Not verified |
| Telnyx | Text message delivery. | Customer-data processing | Not verified | Not verified |
| Postmark | Transactional and account email delivery. | Customer-data processing | Recipient email addresses and message content | Not verified |
| Retell | Inbound voice call booking. This integration is not yet active in production (no live configuration is currently deployed) and is listed here in case your organization enables it. | Optional or inactive integration | Not verified | Not verified |
| Intuit / QuickBooks Online | Accounting sync, only if you connect your QuickBooks account. | Optional or inactive integration | Not verified | Not verified |
| Cloudflare | Private document storage (R2), and a gateway that relays requests to most of the automated data-processing providers below. One of them, Zai, always connects directly rather than through this gateway. | Customer-data processing | Private documents stored in R2, and the requests relayed to the automated data-processing providers | Not verified |
| Google Maps Platform | Geocoding service addresses and rendering the dispatch map. | Customer-data processing | Service addresses | Not verified |
| Sentry | Error monitoring, to help us find and fix bugs, including, in the web app, a masked recording of the moments before an error. | Customer-data processing | Not verified | Not verified |
| PostHog | Product usage analytics and masked session recordings, hosted in the US. Web traffic reaches PostHog through our own domain. | Customer-data processing | Product usage events and masked session recordings | US |
| Inngest | Background job scheduling (for example, reminders and scheduled reports). | Customer-data processing | Not verified | Not verified |
| Anthropic | Anthropic drafts suggested customer-service replies and grounded help answers over your account's own documentation excerpts. | Customer-data processing | Not verified | Not verified |
| Google Gemini | Google Gemini triages inbound call details and other structured product automation tasks. | Customer-data processing | Not verified | Not verified |
| OpenAI | OpenAI reads equipment nameplate photos and helps match spreadsheet columns during data import. | Customer-data processing | Not verified | Not verified |
| Zai | Zai is a failover provider for the same product automation tasks listed above. | Customer-data processing | Not verified | Not verified |
| DeepSeek | DeepSeek handles internal, non-customer tasks only: it checks our public changelog before it is published, reading the planned and written entries, the titles, descriptions and changed file names of our own merged code changes, recently published entries, and the titles of the public roadmap ideas an entry links to; and it reviews some proposed changes to our own source code. It never receives your organization's Customer Data. Reached only through our Cloudflare gateway, never called directly. | Internal-only processing | Not verified | Not verified |