Legal · Transparency
Subprocessor List
These are the categories of third-party service providers ("subprocessors") that may process personal information on OnlyHOA's behalf to operate the Platform. Each is engaged under confidentiality and data-protection obligations and processes information only to provide its service to us. We keep this list current as our infrastructure evolves.
This register accompanies our Privacy Policy and Data Processing Addendum. It lets us describe provider categories in the policy itself while giving customers and residents transparency into the specific providers, without pinning a brittle list into the policy text.
| Provider | Purpose | Data processed |
|---|---|---|
| Microsoft Azure (Blob Storage, Key Vault) | Cloud hosting, file/document storage, secrets management | Uploaded documents, photos, avatars, and files; encryption keys/secrets (no user content in Key Vault) |
| Provider | Purpose | Data processed |
|---|---|---|
| Google (OAuth) | Optional single sign-in | Name, email received at sign-in (if you choose Google login) |
| Microsoft (OAuth) | Optional single sign-in | Name, email received at sign-in (if you choose Microsoft login) |
| Provider | Purpose | Data processed |
|---|---|---|
| Stripe | Payment-card processing | Card details, amount, payer identity (entered on the provider's secure fields) |
| Finix | Card & bank (ACH) processing | Card/bank details, amount |
| Dwolla | Bank (ACH) transfer processing & identity verification | Bank account, name, amount; identity-verification data (e.g., SSN digits/DOB) passed to the provider and not retained by OnlyHOA |
| Plaid | Secure verification of a linked bank account | Bank credentials handled by the provider directly; OnlyHOA receives a token, not credentials |
| Provider | Purpose | Data processed |
|---|---|---|
| Azure Communication Services, IONOS, SendGrid, Mailgun (email delivery, with failover) | Sending platform & community email | Recipient email address, message content |
| Sinch | Text-message (SMS) delivery | Mobile number, message content |
| Apple (APNs), Google (FCM), and browser push services | Mobile & web push notifications | Device/push token, notification payload |
| Lob | Physical-mail (letter) delivery of notices | Recipient name, mailing address, document content |
| Provider | Purpose | Data processed |
|---|---|---|
| Anthropic (Claude) | AI text drafting, summarizing, triage, Q&A (default provider) | Prompts with personal identifiers tokenized/removed before sending; SSN & card numbers blocked (see Privacy Policy §6) |
| OpenAI | AI text (fallback/alternate model); optional meeting-audio transcription; optional AI image generation | Tokenized text prompts; for transcription, meeting audio; for image generation, the description you type |
| Microsoft Azure Document Intelligence | Optional scanning/parsing of an uploaded insurance certificate (OCR) | The uploaded certificate document |
| Provider | Purpose | Data processed |
|---|---|---|
| TaxBandits | Vendor tax-form (1099) filing | Vendor name, tax-identification number, payment totals |
| Nominatim (OpenStreetMap) | Geocoding a property address to map coordinates | Property street address (not a person's device location) |
Runs locally — listed for transparency, but receives no data: MaxMind GeoLite2 is used to approximate a sign-in's city from an IP address. The lookup runs against a database stored on our own servers, so no information about you is sent to MaxMind (its license key is used only to download database updates).
Providers may change as we improve the Platform. Management-company customers can request advance notice of material subprocessor changes under our Data Processing Addendum. Questions: legal@onlyhoa.com.
© 2026 OnlyHOA LLC · All rights reserved.