Service Providers and Subprocessors

Roles and scope

This notice accompanies the Website and YSUITS ID Privacy Notice, Product Privacy Addendum and any applicable Customer Data Processing Addendum. A provider supporting our own account or website operations can be our service provider. A provider processing customer-controlled records on our behalf can be a subprocessor. A customer's independently selected external service can instead process under that customer's own agreement.

A provider's appearance in software source, an integration menu or an evaluation report does not establish that it receives production customer data. This register distinguishes those situations. It is not permission to activate a provider, disclose a new category of information or transfer restricted records.

Hosting and account infrastructure

Google Cloud provides infrastructure used to host YSUITS services. Hosting can involve account and organization records, stored service content, network requests and the technical information needed to run and secure the relevant systems. The Google contracting entity is determined by the applicable Google Cloud agreement.

Hosting location, support access, backups and optional services are separate processing considerations. Do not assume that a hosting region guarantees all access or all provider processing remains in that region. Contact support@ysuits.com for the processing-location and contractual information relevant to your proposed organization deployment before sending information subject to a location restriction.

The provider schedule for the relevant service must also identify the provider delivering account messages or payment processing where those functions are enabled. We identify material additional providers and their roles before relying on them for customer-controlled processing.

Document-recognition evaluations

Google Cloud Document AI has been used for an expressly authorized, limited document-recognition evaluation. That evaluation involved the submitted document pages and returned recognition results. Evaluation evidence does not establish that the same processor is enabled for every production YERP upload.

For a production document-processing function, the actual enabled provider and relevant configuration must be confirmed before disclosure. The AI Feature Privacy Notice explains the content involved and why a recognition result is subject to review. A provider's data-processing terms or certifications are not YSUITS certifications.

Customer-selected connections

Banking, payment, email, document-storage and other external connections are optional capabilities only where enabled. A connection can involve the external account identifier, authorization token, selected records and synchronization results. The connection's authorization screen and service description must explain the requested access. A name such as Plaid, Stripe, Google or Microsoft in a roadmap or software package does not establish an active connection.

Review both the YSUITS disclosure and the external service's own privacy terms. Disconnecting generally stops further authorized access through that connection; imported records, completed transactions, legal evidence and provider records may need separate deletion or retention handling. Never send a banking password or a complete access token in a privacy request.

Provider safeguards and changes

Customer-controlled processing requires appropriate written provider restrictions, confidentiality, security, purpose limits and assistance with applicable privacy obligations. Access should be limited to what the provider needs for the stated task. Where the DPA applies, its authorization, advance-change notice, objection and downstream responsibility terms govern subprocessors.

If a proposed provider or country would change a contractual processing restriction, that restriction must be addressed before the affected processing begins. Publishing a general register does not execute Standard Contractual Clauses, establish Data Privacy Framework participation or supply a taxpayer's separate consent.

Ask support@ysuits.com for the provider schedule and location information for your service, to raise an objection under an applicable DPA or to report an undisclosed provider use. Do not send the underlying confidential records in the initial message.