Subprocessors
The third parties involved in running this business, what each does, and where it processes data.
How to read this page
A subprocessor is a third party that may process personal data on our behalf. We keep the list deliberately short, because every supplier added is another place data can go wrong and another vendor review our clients have to run.
The first table covers what runs this website. The second covers suppliers that may touch client personal data during an engagement. The third explains the platforms we work in that are not our subprocessors at all, which is a distinction that matters when you are filling in a vendor questionnaire.
Website and infrastructure
| Provider | What it does | Data it may see | Processing location |
|---|---|---|---|
| Railway Corporation | Hosts and serves this website | IP address, user agent and request paths, in standard server logs | United States |
| Google LLC (Google Fonts) | Delivers the typefaces the site uses | IP address and browser details, from the font request itself | United States and global edge network |
That is the whole list for the website. There is no analytics provider, no tag manager, no advertising pixel, no chat widget, no A/B testing tool and no consent platform, because none of them is installed. The cookie policy covers the same ground from the visitor's side.
Engagement subprocessors
We work inside our clients' own systems wherever we can, which keeps this list close to empty. Where an engagement requires a supplier that would process your personal data, we name it in the statement of work before the work starts, and we add it here.
Specialists we bring in for production work, such as design, video, development or digital PR, are engaged under written terms carrying confidentiality and data protection obligations equivalent to our own. Where such a specialist would process your personal data, we tell you who they are and what they need before granting any access.
Platforms in your own name
This is the part vendor questionnaires usually get wrong, so it is worth stating plainly.
Google Ads, Google Analytics, Meta, LinkedIn, Microsoft Advertising, your CRM, your email platform and your website host are not our subprocessors. Those accounts are created in your name, owned by you, and governed by your own contract with each provider. We access them under delegated permissions that you grant and can revoke at any time. We are not in the contractual chain between you and them, and we cannot pass on terms on their behalf.
What that means in practice: the controller relationship with those platforms is yours, the data processing terms you need are the ones you have signed with them, and if you remove our access the data stays exactly where it was. It also means we never hold your advertising or analytics data hostage, because we were never holding it.
Notice of changes
We give at least thirty days' notice before adding or replacing a subprocessor that would process client personal data. To receive that notice by email, write to [email protected] asking to be added to the subprocessor notification list, and we will keep you on it for the length of the engagement.
Clients may object to a new subprocessor on reasonable data protection grounds within the notice period. The process, including the right to terminate the affected services without penalty if we cannot resolve the objection, is set out in our data processing addendum.
Questions about this document
Write to Stratovia Consulting LLC, 3831 Montgomery Blvd NE, Apt 433, Albuquerque, NM 87109, United States, or email [email protected]. We answer within 30 days, and sooner where the law requires it.