Subprocessors
Last updated: January 29, 2026
ioZen uses the following third-party sub-processors to deliver our Service. All sub-processors are bound by data processing agreements with obligations no less protective than our Data Processing Agreement.
Current Sub-processors
Infrastructure
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Supabase | Database, authentication, storage | United States | Account data, user content, authentication credentials |
| Vercel | Application hosting, deployment, AI Gateway, file storage (Blob) | United States | Application data, usage logs, AI request routing, file uploads and exports |
| Cloudflare | CDN, DDoS protection, DNS | Global (US-based) | IP addresses, traffic data |
| Upstash | Redis caching, message queues (QStash), rate limiting | United States | Session data, job queues, rate limit counters |
| Postmark | Transactional email (notifications, invitations, alerts) | United States | Email addresses, notification content |
| Loops | Marketing email and contact management | United States | Email addresses, user profile data |
| Stripe | Payment processing | United States | Payment information, billing details |
Conversion & Attribution
When customers enable marketing attribution and conversion tracking, submission data may be sent to the following ad platforms via server-side APIs. All personally identifiable information (PII) is SHA-256 hashed before transmission.
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Meta (Facebook/Instagram) | Conversions API: server-side conversion event tracking | United States | Hashed user data (email, phone), event name, event value, click ID (fbclid) |
| Measurement Protocol: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (gclid) | |
| Conversions API: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (li_fat_id) | |
| TikTok | Events API: server-side conversion event tracking | United States | Hashed user data, event name, event value, click ID (ttclid) |
AI Providers
All AI processing is routed through Vercel AI Gateway. User content submitted to AI features never includes Private or Encrypted fields. The following AI providers may process data depending on the model selected:
| Sub-processor | Purpose | Location | Models |
|---|---|---|---|
| OpenAI | AI-powered features (form generation, field intelligence, validation) | United States | GPT-4o, GPT-4o Mini, O1 |
| Anthropic | AI-powered features (form generation, field intelligence, validation) | United States | Claude Sonnet 4, Claude 3.5 Haiku, Claude Opus 4 |
| AI-powered features (form generation, field intelligence, validation) | United States | Gemini 2.5 Flash, Gemini 2.5 Flash Lite | |
| xAI | AI-powered features (form generation, field intelligence, validation) | United States | Grok 2, Grok 3 |
Changes to Sub-processors
We will notify customers of any new sub-processors at least 30 days before they begin processing personal data. As described in our DPA, you may object to a new sub-processor within 30 days of notification.
Stay Informed
To receive notifications about sub-processor changes, email us at privacy@iozen.ai with the subject line “Sub-processor Updates”.
Questions
If you have questions about our sub-processors or their data practices, contact us at privacy@iozen.ai.