01
Your data stays yours
Every customer's data is isolated from every other customer's through row-level security, so one business's clients, work orders, invoices, and team information are not accessible to another business on TradelyHQ.
Security
Built to keepyour data safe.
Your work orders, client information, invoices, and field data deserve the same care your business does. We take that seriously at every layer.
Our promises
Four things we get rightso you don't have to think about it.
02
Everything is logged
Every meaningful action, such as who created a work order, who marked an invoice paid, and who changed a permission, is recorded in a detailed, append-only audit log designed to resist tampering. If something needs investigating later, the history is there.
03
Your privacy is protected
Customer-identifying information is handled with care across our systems. We follow the applicable US privacy laws that cover our customers, including the California CCPA and CPRA, and you can request your data be exported or deleted from your account settings at any time.
04
Continuously tested
Our security posture is reviewed regularly, not just at launch. We run automated checks on every change we ship and carry out periodic security reviews to help keep the standard high.
Subprocessors
The companies we useto run TradelyHQ.
We don't run every piece of TradelyHQ ourselves. A handful of trusted services help us host the app, send emails, and keep the lights on. Here's the full list, what each one does, and what they see.
Supabase
United States
Stores your database, handles sign-in, holds your uploaded files, and runs our back-end functions.
Sees: everything you save in TradelyHQ, including work orders, clients, invoices, attachments, and account info.
Vercel
United States
Hosts the TradelyHQ website and the app itself.
Sees: the pages and requests that flow through the app, not the contents of your records.
Stripe
United States
Handles the payment side. It processes the card payments for your TradelyHQ subscription, and, if you turn it on, the online payments your own clients make on your invoices. Either way we never touch the card or bank numbers ourselves.
Sees: your billing details, and the card or bank details your clients enter to pay you online. Those go straight to Stripe.
Resend
United States
Sends the transactional emails we ship on your behalf, such as invoice reminders, password resets, and team invites.
Sees: the email addresses and contents of those messages.
Crisp
France
Powers the in-app support chat, the little bubble in the corner.
Sees: only the email and chat messages of people who actually start a conversation. If you never open chat, Crisp sees nothing about you.
Sentry
United States
Watches for errors so we can fix things before they pile up. Only active if you accept the "Analytics" cookie option.
Sees: error details and session replays, with anything you typed and any form values automatically blacked out.
Better Stack
European Union
Tells us if the app goes down and keeps the logs we use to diagnose problems.
Sees: our own service-health signals, such as uptime checks and back-end logs. No customer information.
Cloudflare R2
United States
Stores some of the photos and media you upload, such as job-site pictures and attachments.
Sees: the files you upload. Nothing else about your account.
Cloudflare Turnstile
United States
Protects the signup form against bots and automated abuse.
Sees: signals from the signup page used to tell real people from automated abuse. Not your account records.
Anthropic
United States, optional
Powers the optional writing-assist, intake-autofill, and in-app translation features, plus AI-assisted dispatching, scheduling, automation, and agent features. Only runs when you choose to use one of them.
Sees (if used): only the work-order, scheduling, payout, and related details needed to perform that feature. We do not let it train its models on your content.
OpenAI
United States, optional
Turns voice notes into text when you use the optional voice-note feature.
Sees (if used): only the audio you record for transcription. We do not let it train its models on your content.
Apple and Google push
United States, optional
Deliver push notifications to your phone or browser, if you turn notifications on.
See (if enabled): a device push token and the notification we send you. Not your account records.
U.S. Census Bureau Geocoder
United States
Converts the site and customer addresses you enter into map coordinates, for route planning and sales-tax jurisdiction lookup.
Sees: the addresses you enter, sent for coordinate lookup. Not your full account records.
OpenStreetMap Foundation / Nominatim
European Union
Fallback address-to-coordinate lookup when the Census geocoder returns no match.
Sees: the address looked up, only when the Census geocoder finds no match. Not your full account records.
If you connect the Service to your own QuickBooks Online, MaintainX, or Corrigo account, or share a work order with an outside subcontractor through an access link, we send your data to that account or recipient because you told us to. Those aren't subprocessors on the list above, but integrations and disclosures you control, and their use of your data is governed by your relationship with them, not by us.
Separately, our marketing website (the pages you're reading now, not the app) uses Google Analytics from Google LLC (United States) for website analytics on our marketing pages. It uses cookies and device identifiers to measure visits, traffic sources, and page usage. That's visitor analytics we run in our own capacity, and it never touches the data inside your TradelyHQ account.
This list is current as of July 11, 2026. We update this page whenever a subprocessor is added, changed, or removed.
Built so you can stop worrying about it.
Data encrypted in transit and at rest. Applicable privacy laws followed. We don't sell your information. The basics, done right.