Subprocessors
Effective date: July 18, 2026
HOA in a Box engages the third parties listed below to help provide, secure, and support the HOA in a Box platform (the "Services"). A "subprocessor" is a third party that may process personal data on HOA in a Box's behalf. This list supplements our Data Processing Addendum and Privacy Policy. Each subprocessor is engaged under contractual confidentiality and data-protection obligations and processes personal data only as needed to perform its function.
1. Infrastructure and hosting
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Compute, managed Kubernetes, block storage and backups. Each association's database, authentication and files run in their own isolated namespace and volume. | United States |
| Cloudflare, Inc. | DNS, TLS termination, content delivery, DDoS protection, and the tunnel through which each association's site is reachable. Cloudflare sees traffic in transit; it is not a store of association records. | United States (global edge) |
2. Payments
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Card and bank payment processing, and the checkout in which a payer enters their details. Card numbers are submitted directly to Stripe and never reach our systems. Stripe is an independent controller of the payment data it collects; see Stripe's own privacy policy. | United States |
3. Communications
| Subprocessor | Purpose | Location |
|---|---|---|
| Resend, Inc. | Transactional email — official notices, board correspondence, payment receipts, sign-in and account messages. Processes recipient name, email address and message content. | United States |
4. Not engaged
To be explicit about what is absent, because it is as much a part of this disclosure as what is present. We do not engage an advertising network, an analytics provider that profiles individuals across sites, a data broker, a customer-data platform, or any third-party model provider. Association and resident records are not used to train anything, by us or by anyone we engage.
Two things are planned and are not in use today. When posted mail is added, a print-and- post provider will appear here before any notice is sent through it. When text messaging is added, a messaging provider will appear here before any message is sent.
5. Per-association isolation
Each association's records live in a database of their own rather than in shared tables separated by a column. The subprocessors above provide the infrastructure that isolation runs on; none of them is a shared store in which one association's records sit beside another's.
6. Changes to this list
We may update this list as we add, replace, or remove subprocessors. When we make a material change, we will revise the effective date above and, where required by the Data Processing Addendum, notify customers who have subscribed to subprocessor change notifications. To subscribe to notifications or to object to a new subprocessor on reasonable data-protection grounds, contact [email protected].
7. Contact
Questions about our subprocessors: [email protected].
Last updated: July 18, 2026