What is listed
Vendors that may process visitor or inquiry data for analytics, contact intake, embeds, or support workflows.
Vendor Transparency
Subprocessors
Public list of subprocessors currently relevant to the SpeakUp public website and related inbound workflows.
Last updated: March 30, 2026
What is not listed
Customer-specific product environments, infrastructure detail, or contract schedules may cover a broader scope.
Change handling
This list should be updated when website tooling changes or when optional providers become active.
Customer follow-up
Contact SpeakUp if your review requires an in-scope, contract-specific subprocessor view.
SpeakUp Trust Portal
Privacy, security, vendors, and review materials in one place
Find the key public trust documents, follow-up review materials, and the right next step without bouncing between separate policy pages.
Core documents
A subprocessor is a third party that processes personal data on behalf of a processor or service provider.
The providers listed below are the ones currently used on, or directly connected to, the public SpeakUp website and related inbound contact flows.
01
How to read this list
- Some providers are always present on the public website, while others are conditional and become active only after visitor consent or deployment-specific enablement.
- This page focuses on the public website. Customer-specific product environments or executed agreements may include a broader or different subprocessor scope.
- Where a provider offers multiple related services, the row below summarizes the service most relevant to the public website.
- Infrastructure providers that are relevant only to customer environments should be documented in customer-facing procurement or executed DPA materials when in scope.
02
Subprocessors currently relevant to the public website
This list reflects the public website implementation and public legal disclosures as of the date above.
Google LLC
Google Analytics
- Purpose
- Website measurement, engagement reporting, performance diagnostics, and aggregate analytics continuity.
- Data categories
- Page-view metadata, page URLs and titles, browser and device signals, analytics identifiers, and high-level engagement events.
- Processing location
- Provider-operated infrastructure that may involve processing outside the visitor’s region.
- Notes
- Loaded only when optional analytics is allowed through the site consent flow.
Google LLC
Google Maps embed
- Purpose
- Embedded map content on the contact page when the visitor allows optional embedded content.
- Data categories
- IP address, browser metadata, map interaction signals, and any provider-controlled cookies or similar technologies tied to the embed.
- Processing location
- Provider-operated infrastructure that may involve cross-region processing.
- Notes
- The map iframe is blocked until embedded content is allowed.
Google LLC
Google Apps Script
- Purpose
- Receives contact-form submissions and routes them into the current intake workflow.
- Data categories
- Name, email address, message content, and contact-form confirmation state.
- Processing location
- Provider-operated infrastructure that may process data outside the user’s region.
- Notes
- Applies when a visitor submits the contact form.
Cloudflare, Inc.
Cloudflare trace endpoint
- Purpose
- Returns a coarse country code used by the location-based banner logic.
- Data categories
- IP address and request metadata visible to the provider when the trace endpoint is called.
- Processing location
- Provider-operated global edge infrastructure.
- Notes
- Used for the location-banner flow; not every visitor will trigger the same banner path.
Chatwoot
Support chat widget
- Purpose
- Provides chat state and support messaging if chat is enabled in the active deployment.
- Data categories
- Visitor identifiers, session state, message content, and any related support metadata generated in chat.
- Processing location
- Depends on the deployed Chatwoot environment.
- Notes
- Only relevant if support chat is explicitly enabled for a given environment.
03
How this list is maintained
- Review this page when adding or removing analytics, support, embed, routing, or contact-intake vendors.
- Update related privacy, cookie, and security pages at the same time so public disclosures stay aligned.
- If a customer contract requires notice or approval for subprocessor changes, the executed contract should govern that process.
- Production infrastructure, logging, and hosting vendors should be cross-checked against the active environment before this list is used in procurement.
04
Questions about subprocessors
Contact us if you need clarification on the current list, customer-specific scope, or customer-review subprocessor information.
Subprocessor contact
contact@speak-up.proTrust Workflow
Need a structured package for legal, privacy, or security review?
Use the Trust Package path when your team needs the next layer beyond the public trust pages.