KeyBoltSub-processors
Last updated: June 15, 2026
KeyBolt relies on the third-party sub-processors below to deliver the platform. Each is contractually bound by data processing terms equivalent to or stronger than those in our Privacy Policy.
We will provide at least 30 days' notice at this URL before adding a new sub-processor. To receive notifications by email, write to privacy@keybolt.tech.
| Sub-processor | Role | Country |
|---|---|---|
| Supabase | Primary database, authentication, file storage. Stores all customer records, jobs, invoices, key codes, photos, and identity-verification uploads. | United States (Northern Virginia, AWS us-east-1) |
| Stripe | Payment processing for subscription billing and shop-to-customer invoices. Stripe Connect routes payouts to the locksmith’s bank account; Stripe Terminal handles in-person card readers. | United States |
| Telnyx | Telecommunications carrier for KeyBolt Pro — voice calls, SMS, MMS, A2P 10DLC registration, call recording, and Whisper-based transcription. Acts as the underlying carrier for the shop’s business phone number. | United States |
| Resend | Transactional email delivery — invoices, payment receipts, team invites, password resets. | United States |
| Cloudflare Turnstile | CAPTCHA on signup, contact form, password reset, and customer-portal flows. No tracking cookies. | United States (with global edge) |
| Sentry | Error tracking and (with consent in EU/UK) session replay for debugging. Replay records anonymized DOM interaction; PII is scrubbed at the SDK before transmission. | United States |
| Vercel | Application hosting, edge runtime, and analytics. Receives request metadata (IP, user-agent, geo) for serving the application. | United States |
| Google (Local Services Ads) | Optional integration on KeyBolt Pro. When connected, KeyBolt pulls LSA leads via the Google Ads API v24 and posts replies on the locksmith’s behalf. Google’s sub-processor when handling LSA conversation content. | United States |
| Google (Merchant Center / Content API) | Optional integration on KeyBolt Pro. When a locksmith connects a Google Merchant Center account, KeyBolt syncs the shop’s online-storefront product listings (titles, descriptions, prices, availability, and product images) to Google so they can appear in Google’s free product listings. Only product-catalog data is sent; no customer or order information is shared through this integration. | United States |
| OpenStreetMap Foundation (Nominatim) | Address geocoding for the route planner. When a job or customer address needs lat/lng, the address is sent to the public Nominatim service and the result is cached for 30 days. The local cache is keyed on a SHA-256 hash of the address — only the hash, lat, and lng are stored on our side. | United Kingdom |
| OpenFreeMap | Map tile rendering for the in-app jobs map. The user’s browser fetches vector tiles directly from the tile CDN, which receives the user’s IP and the map area being viewed. OpenFreeMap is donation-funded and does not log requests or run analytics. | European Union |
| Project OSRM | Multi-stop route optimization for the field-tech route planner. Only the stop coordinates (lat/lng pairs) are sent — no customer names, addresses, or contact information. | Germany |
| AI model providers via the Vercel AI Gateway (currently Google Gemini, OpenAI) | Powers the optional in-app AI helper, the drafting of jobs from inbound customer emails, and (on KeyBolt Pro) call-transcript summaries and field suggestions. Conversation text, inbound email content (sender, subject, body), and call transcripts are routed through the Vercel AI Gateway, currently to Google (Gemini models, for the chat helper, job-draft generation, and call summaries) and to OpenAI (text-embedding models, for search indexing). The structured key-code, bitting, and safe-combination fields on customer records are never sent. The providers are directed, via the Vercel AI Gateway, not to use content for model training; brief provider-side retention for abuse monitoring under standard API terms, then deleted. | United States (provider routing may vary) |
| Cloudflare (Email Routing + Workers) | Receives inbound customer emails sent to your KeyBolt inbox address (your-shop@inbox.keybolt.tech). A Cloudflare Worker reads the message and any attachments and files them into KeyBolt for routing to the Colab inbox. Distinct from Cloudflare Turnstile (CAPTCHA), which is listed separately. | United States (with global edge) |
Data Processing Addendum
A standard Data Processing Addendum (DPA) incorporating the EU Standard Contractual Clauses and UK Addendum is available on request. Email privacy@keybolt.tech to receive a countersignable copy.