OPVII

Subprocessors

Every provider that touches your data, and what it receives.

Get Started See Pricing

Professional Onboarding No Contracts Cancel Anytime

Email And Text, On Schedule

The full reminder cadence runs off one registration, with nobody sending anything.

One Inbox For Replies

Texts and emails come back already matched to the attendee and the event.

Attendance In One Click

Mark who walked in and the show rate updates itself.

This register was last verified on October 10, 2026. It is published rather than sent on request, and it is the authoritative list: if a provider is not on it, it does not process data on your behalf.

The Register

Each provider receives only what it needs to perform its function, is bound by written terms no less protective than our own Data Processing Addendum, and is prohibited from using your data for its own marketing or selling it onward.

The certifications shown against each provider are held by that provider. They are not ours, and we do not present them as ours. What we do and do not claim for ourselves is on the Trust Center at /trust.

OPVII

Application And Database Hosting

ReceivesAll Platform Data

Location United States

First Party

Cloudflare

DNS, CDN, Firewall, Inbound Mail Routing

ReceivesRequest Metadata, Traffic In Transit

Location Global Edge, United States Origin

SOC 2 Type II ISO 27001 PCI DSS

Stripe

Subscription Billing

ReceivesBilling Contact, Card Token

Location United States

PCI DSS Level 1 SOC 1 SOC 2

Twilio SendGrid

Transactional And Campaign Email

ReceivesRecipient Email, Name, Message Body

Location United States

SOC 2 Type II ISO 27001

Amazon SES

Email Delivery

ReceivesRecipient Email, Name, Message Body

Location United States

SOC 1 SOC 2 SOC 3 ISO 27001

Twilio

SMS Delivery

ReceivesRecipient Number, Message Body

Location United States

SOC 2 Type II ISO 27001

SignalWire

SMS Delivery And Inbound Replies

ReceivesRecipient Number, Message Body

Location United States

SOC 2

AWS End User Messaging

SMS Delivery

ReceivesRecipient Number, Message Body

Location United States

SOC 1 SOC 2 SOC 3 ISO 27001

Google

Marketing Site Analytics And Ad Measurement

ReceivesPseudonymized Site Usage, Marketing Pages Only

Location Global

ISO 27001 SOC 2 SOC 3

How A Change Is Handled

We give notice before adding or replacing a subprocessor. You have 30 days to object on reasonable data protection grounds, and we will work with you to find a solution. If none is available you may terminate the affected part of the service and receive a prorated refund for the unused period. The clause is set out in full in the Data Processing Addendum at /dpa.

Where The Data Sits

The platform and its database run in the United States. Every provider above is either United States based or operates a global edge with a United States origin. There is no European hosting region today.

Transfers out of the EEA, the United Kingdom or Switzerland rely on the Standard Contractual Clauses incorporated into the Data Processing Addendum, with the United Kingdom International Data Transfer Addendum and the Swiss Federal Act on Data Protection applied on top where relevant.

Analytics Is The Marketing Site Only

Google receives pseudonymized usage data from our public marketing pages, which is how we tell which pages do the work. It receives nothing from inside a workspace, nothing from the attendee portal, and no registrant record. For a visitor in the EEA, the United Kingdom or Switzerland, no analytics or advertising cookie is set at all until consent is given. The Cookie Policy at /cookies names every cookie.

Contact

Questions about this register, or a request for the written terms with a particular provider, go to dev@opvii.local.