Legal
Subprocessors
The outside services that can hold or see personal data 1Stop processes, listed against a direct read of the code that is actually deployed.
Draft pending legal review
No lawyer has reviewed this document. It was drafted in-house so counsel has something concrete to mark up, and it is published here for that purpose. It is not legal advice, and 1Stop does not represent that it is enforceable as written. Nothing on this page should be relied on until a licensed attorney has signed off on it.
- Version
- 0.1
- Drafted
- 5 September 2026
- Status
- Draft, not in force
1What this page is
These are the third parties that can hold or see the personal data 1Stop processes, listed so a Client can check them before signing. Personal data here means names, work emails, phone numbers, property and unit addresses, job start and end coordinates, photographs of the interiors of private residences, IP addresses and user agents recorded on signatures and audit rows, and invoice amounts.
This is a factual inventory taken directly from the code as it stands. It is not a legal representation, it does not assert compliance with any law, and it is a draft that has not been reviewed by a licensed attorney.
2The list
Two companies currently receive data because the deployed code sends it to them.
| Service | What it does | What it receives | Status |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the application, the Postgres database and the web server | Every piece of personal data 1Stop processes, because it sits on Hetzner's disks | In use |
| Hetzner Online GmbH | S3-compatible object storage | Uploaded photographs, compliance documents, vendor logos and generated PDFs | Only when configured |
| Twilio Inc. | Sends one-time passcodes by SMS for phone sign-in | The recipient's phone number and the passcode text | Only when configured |
Hetzner, hosting. The whole application, the Postgres database and the web server run on a single Hetzner server, so Hetzner holds the disks that every piece of personal data 1Stop processes sits on.
Hetzner, object storage. The storage adapter can target Hetzner's S3-compatible endpoint at https://fsn1.your-objectstorage.com. What it receives is every uploaded file: before and after photographs of unit interiors, uploaded compliance documents such as certificates of insurance and W-9s, vendor logos, and generated PDF documents. This path is only active when the four STORAGE_S3_* environment variables are set. When they are not set, files are written to local disk on the same Hetzner server instead. Either way the data stays on Hetzner infrastructure.
Source: src/lib/storage/s3.ts and src/lib/storage/local.ts.
Twilio, SMS passcodes. The code calls Twilio's REST API directly at https://api.twilio.com/2010-04-01/Accounts/.../Messages.json to deliver the one-time passcode that lets a provider or crew member sign in by phone. What it receives is the recipient's phone number and the text of the message, which contains the passcode. This path is only live when TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN and TWILIO_FROM_NUMBER are all set. When they are not set, the code writes the message to the server log instead and no data leaves the server.
Source: src/lib/auth/sms.ts.
3Declared but not connected
Two environment variables exist in the project's example configuration file without any code path that uses them. A variable existing in an example configuration file is not the same as a service being used, and neither of these receives anything today.
Resend. A RESEND_API_KEY variable exists in .env.example, but nothing in the application sends email. There is no email-sending code path at all. Documents are delivered inside the platform, not by email.
A map tile provider. A MAP_TILE_URL variable exists in .env.example, but it is never read anywhere in the code, and no mapping library is installed. No tile provider receives anything, and no map request carries a property address or a coordinate to a third party today.
4Not subprocessors
Two components are worth naming here so nobody assumes they are third parties receiving data.
Postgres. The database runs in a container on the same Hetzner server that runs the application. It is not a managed third-party database service, and no data leaves the server to reach it.
Google Fonts. Typefaces are loaded through Next.js next/font/google, which downloads the font files at build time and serves them from 1Stop's own domain. A visitor's browser makes no request to Google, and Google receives no visitor IP address.
5What is not here
The absences below matter as much as the entries above. Each one is a category of service that many comparable platforms use, and that this deployment does not.
- No analytics or product-analytics service of any kind. No Google Analytics, no Plausible, no PostHog, no Segment, no Mixpanel.
- No error monitoring or crash reporting service. No Sentry, no Datadog.
- No advertising or marketing pixel, and no tag manager.
- No payment processor and no billing rail. No Stripe. The platform does not process payments.
- No third-party electronic signature vendor. Signing happens in the application itself.
- No third-party identity provider. Sign-in is by email and password or by phone passcode, so no Google, Microsoft or Apple sign-in, and no identity provider receives anything.
- No content delivery network, no third-party script tag and no iframe on any page. A visitor's browser contacts 1Stop's own domain and nothing else.
- No artificial intelligence or machine learning service. No customer data is sent to a model provider.
6Changes to this list
This list describes the code as it stands and the services it is wired to call. Whether the object storage and SMS variables are actually set in the production environment is a deployment question, separate from what the code contains, so this page will be republished if that changes.
If a new subprocessor is added, this page will be updated and Clients will be given [a change-notice period for adding a subprocessor to be set with counsel] before the new subprocessor begins processing data.
See also the Privacy Policy and the contact page for questions about this list.