SpearPoint Security & Data Protection
Sub-processors
SpearPoint uses the service providers below to process customer data on our behalf. Each receives only the data it needs for the purpose listed. Customers who have signed our Data Processing Addendum get notice before we add or replace a sub-processor.
Last updated October 22, 2026
| Provider | Purpose | Data | Location |
|---|---|---|---|
Google LLC Google Cloud and Firebase | Application hosting, databases (Cloud SQL for PostgreSQL and Cloud Firestore), file storage, user authentication, background jobs and secret storage. | All customer data stored in the service, including account details, organization and CRM records, follows, alerts and saved reports. | United States (us-central1 and the nam5 US multi-region). Firebase Authentication and Secret Manager are Google-operated global services. |
Google LLC Gemini API | AI features such as summaries, briefings, reports and natural-language questions. | The text of an AI request and the legislative records needed to answer it. | Processed by Google under the Gemini API terms. |
Google LLC Google Maps Platform (Geocoding) and reCAPTCHA | Converting addresses to map coordinates (organization and CRM contacts, stakeholder uploads, map address search and "find my legislators" district lookups); bot protection on public forms. | Street addresses you enter or import; browser signals collected by reCAPTCHA on public forms. | Processed by Google. |
Stripe, Inc. Stripe Payments and Billing | Subscription billing, payment processing and invoices. | Billing name, email and address, tax IDs, subscription and invoice details. Card details are entered in Stripe Elements fields embedded in our checkout and billing pages, go directly to Stripe, and never reach SpearPoint servers. | Processed by Stripe. |
Microsoft Corporation Microsoft 365 (Exchange Online) | Delivery of account, billing and alert emails sent from contact@spearpointdata.com. | Recipient name and email address and the content of the email. | Processed by Microsoft. |
Twilio Inc. Twilio Programmable Messaging | Text-message alerts, only for users who turn on SMS notifications. | Mobile phone number and the text of the alert. | Processed by Twilio. |
Google LLC
Google Cloud and Firebase
- Purpose
- Application hosting, databases (Cloud SQL for PostgreSQL and Cloud Firestore), file storage, user authentication, background jobs and secret storage.
- Data
- All customer data stored in the service, including account details, organization and CRM records, follows, alerts and saved reports.
- Location
- United States (us-central1 and the nam5 US multi-region). Firebase Authentication and Secret Manager are Google-operated global services.
Google LLC
Gemini API
- Purpose
- AI features such as summaries, briefings, reports and natural-language questions.
- Data
- The text of an AI request and the legislative records needed to answer it.
- Location
- Processed by Google under the Gemini API terms.
Google LLC
Google Maps Platform (Geocoding) and reCAPTCHA
- Purpose
- Converting addresses to map coordinates (organization and CRM contacts, stakeholder uploads, map address search and "find my legislators" district lookups); bot protection on public forms.
- Data
- Street addresses you enter or import; browser signals collected by reCAPTCHA on public forms.
- Location
- Processed by Google.
Stripe, Inc.
Stripe Payments and Billing
- Purpose
- Subscription billing, payment processing and invoices.
- Data
- Billing name, email and address, tax IDs, subscription and invoice details. Card details are entered in Stripe Elements fields embedded in our checkout and billing pages, go directly to Stripe, and never reach SpearPoint servers.
- Location
- Processed by Stripe.
Microsoft Corporation
Microsoft 365 (Exchange Online)
- Purpose
- Delivery of account, billing and alert emails sent from contact@spearpointdata.com.
- Data
- Recipient name and email address and the content of the email.
- Location
- Processed by Microsoft.
Twilio Inc.
Twilio Programmable Messaging
- Purpose
- Text-message alerts, only for users who turn on SMS notifications.
- Data
- Mobile phone number and the text of the alert.
- Location
- Processed by Twilio.
Other services that receive limited data
- OpenStreetMap Foundation (Nominatim)
Backup address lookup, used only when Google geocoding is unavailable (map address search, "find my legislators", imports). The address text typed into the lookup. No account information is sent.
- Google Analytics, Microsoft Clarity, LinkedIn Insight Tag
Website and product analytics. Loaded only after a visitor accepts the matching category in our cookie banner.
Services you connect
If your organization connects a Gmail or Microsoft 365 mailbox to send messages from SpearPoint, that provider is your own service, not our sub-processor. SpearPoint requests send-only permission and keeps the access token in Google Secret Manager. You can disconnect the mailbox at any time.
Questions about a provider? Email contact@spearpointdata.com.
Request a DPA