Trust
Sub processors
To run doTask we use the providers below. Each processes data only to provide its part of the service, under its data processing terms. Certifications are as each provider publishes them on its own trust page.
Used for every workspace
| Provider | What for | Data | Where | Certification |
|---|---|---|---|---|
| Supabase | Database, sign-in, file storage and backups | All workspace data, including conversations, contacts, bookings and uploaded files | Singapore | ISO/IEC 27001, SOC 2 Type II |
| Vercel | Hosts the dashboard, the AI reply service and this website | Data passing through requests; short-lived logs | Singapore; global edge network | ISO/IEC 27001, SOC 2 Type II |
| Cloudflare | The messaging service (receiving and sending messages, the chat widget), DNS, firewall, bot checks on sign-in, and turning voice notes into text | Messages and voice notes in transit; request logs | Global edge network | ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701, SOC 2 Type II |
| Anthropic | Generates the AI Agent's replies and the AI tools in the dashboard | Conversation content and the business's own knowledge sent with each request; not used to train models | United States | ISO/IEC 27001, ISO/IEC 42001, SOC 2 Type II |
| Amazon Web Services (Amazon SES) | Delivers a business's marketing email (newsletters, broadcasts, automated emails) | Recipient email addresses and the email content | Australia (Sydney) | ISO/IEC 27001, 27017, 27018, 27701, SOC 2 Type II |
| Resend | Delivers one-to-one email (ticket replies, invoices, booking emails, sign-in codes) and receives email sent to a business's doTask mailbox | Email addresses and email content | United States | SOC 2 Type II |
| Stripe | doTask's own subscriptions and partner payouts; a business's card payments run through its own Stripe account, connected to doTask | Billing details; card details stay with Stripe | United States and global | PCI DSS Level 1, SOC 2 Type II |
Used when a business connects them
These run only for a business that connects the account, and only for what that connection does.
| Provider | What for | Data | Where | Certification |
|---|---|---|---|---|
| Meta Platforms | WhatsApp, Instagram and Messenger messaging | Messages, names, profile pictures and phone numbers of the people writing | Global | SOC 2 Type II and ISO/IEC 27001 (per Meta's developer documentation) |
| Calendar sync, Contacts import, Business Profile, YouTube, Google Ads, Analytics and Search Console | What the connected feature needs (for example busy times, reviews, posts, conversion events) | Global | ISO/IEC 27001, 27017, 27018, 27701, SOC 2 Type II | |
| Shopify | The doTask app inside a store's admin; store data for the AI Agent; checkout for invoices and bookings | Products, orders and customers of the connected store | Global | PCI DSS Level 1, SOC 2 Type II |
| Notion | A knowledge source for the AI Agent | The pages the business shares with doTask | United States | See Notion's own security page |
Not our subprocessors
- Twilio and Vonage, for SMS, with the business's own account: the business contracts with the provider directly.
Changes
We tell workspace owners by email at least 30 days before adding a subprocessor that will process their customers' data, and update this page. A business that objects can contact us, and may end its subscription before the change takes effect if we cannot meet the objection. See the Data Processing Agreement.
Trust and security
Security · Privacy · Data processing (DPA) · Subprocessors · Status · Uptime (SLA) · Accessibility