Evident Subprocessor List

Last Updated: August 28, 2026 Effective: August 28, 2026

This page lists every third party that Vecto Solutions, LLC uses to process personal data in the course of operating Evident. It is the authoritative list, referenced by:

• The Privacy Policy, Section 4 — for individual users
• The Terms of Service — for individual users
• Exhibit F of the SaaS Master Service Agreement — for customer organizations

Keeping one list in one place is deliberate. If these documents ever disagree about who processes your data, this page is the one that is current.

1. What a Subprocessor Is

Vecto Solutions processes data on behalf of the organizations that license Evident. A subprocessor is a third party we engage to help us do that — a vendor that stores, transmits, or otherwise handles personal data as part of delivering the Service.

Every subprocessor below is bound by a written agreement that requires it to process data only on our instructions, to protect it with appropriate security measures, and to delete it when we say so. We remain responsible to our customers for what our subprocessors do.

A vendor that never touches personal data — an accounting package, a code repository — is not a subprocessor and is not listed here.

2. Current Subprocessors

3. Detail

3.1 DigitalOcean, LLC — Infrastructure

What it does. DigitalOcean provides the servers, managed database, object storage, and backup infrastructure on which Evident runs. Because the application and its database are hosted there, all Customer Data passes through and is stored on DigitalOcean infrastructure.

Where. Evident is deployed in DigitalOcean's New York (NYC) region. Data is stored and processed in the United States.

Contractual basis. DigitalOcean's Data Processing Agreement applies to our account. It designates DigitalOcean as a processor, provides for international transfers under the EU–U.S. Data Privacy Framework with Standard Contractual Clauses and the UK International Data Transfer Addendum as fallback mechanisms, and commits DigitalOcean to delete personal data within 30 days of account deactivation, subject to backup rotation and legal retention.

Security posture. DigitalOcean maintains SOC 2 Type II and SOC 3 Type II attestations issued by Schellman & Company, PCI-DSS SAQ-A validation, and CSA STAR Level 1 self-assessment. Its colocated data center facilities, including the NYC region, hold ISO 27001, ISO 22301, PCI-DSS, SOC 1 Type II, and SOC 2 Type II certifications. Reports are published at digitalocean.com/trust/certification-reports.

Its own subprocessors. DigitalOcean engages its own subprocessors, published at digitalocean.com/trust/subprocessors. At the time of writing these include Amazon Web Services (backup infrastructure), Cloudflare (platform security), and Traversal (support tooling). DigitalOcean gives at least 30 days' notice before adding or replacing a subprocessor, and we monitor that list.

On deletion. When we execute a deletion request under Section 5 of the Privacy Policy, the data is removed from the production database and object storage hosted here, and passes out of DigitalOcean's backups on our 35-day rotation.

3.2 Apple Inc. — Push notification delivery (iOS)

What it does. When Evident sends a push notification to an iOS device — a new work assignment, a message — the notification is handed to Apple's Push Notification service, which delivers it to the device.

What Apple receives. The device's APNs push token and the contents of the notification payload. Apple does not receive your work records, location history, or account credentials.

Contractual basis. APNs is provided to us as part of the Apple Developer Program. Our use is governed by Apple's developer terms and Apple's published privacy commitments; Apple states that it does not use notification content to build user profiles.

3.3 Google LLC — Push notification delivery (Android)

What it does. The Android equivalent of the above. Notifications for Android devices are delivered through Firebase Cloud Messaging.

What Google receives. The device's FCM registration token and the contents of the notification payload. Google does not receive work records, location history, or account credentials through this service.

Contractual basis. Google's Firebase Data Processing and Security Terms apply, under which Google acts as a processor, with Standard Contractual Clauses available for transfers where required.

This is separate from Sign in with Google. See Section 4.

4. Not Subprocessors

Two things people reasonably expect to find on this list are absent, for a reason worth stating.

Sign in with Google. Where an organization enables it, you authenticate directly with Google and Google returns identity claims to Evident. Google is not processing data on our behalf in that exchange — it is operating its own service under its own terms, as an independent controller of your Google account. We receive only the claims described in Section 2.2 of the Privacy Policy. This is why Google appears in Section 2 above for push delivery, where it is our processor, but not for authentication, where it is not.

Your organization. Your employer is not our subprocessor. The relationship runs the other way: your organization is the controller of the work records created through Evident, and Vecto Solutions is its service provider. Section 1 of the Privacy Policy explains that arrangement.

Mobile operating systems and app stores. Apple and Google also distribute the Evident app and provide the operating systems it runs on. Those are platform relationships governed by their own terms, not processing carried out on our instructions.

5. Changes to This List

We give at least 30 days' notice before adding or replacing a subprocessor that processes Customer Data. Notice goes to each customer organization's designated contact.

Customer organizations may object. If a customer reasonably objects to a new subprocessor on data-protection grounds and we cannot resolve the objection, that customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees. This mirrors Exhibit F of the SaaS Master Service Agreement.

Individual users cannot object to a subprocessor directly — the contractual right belongs to the organization that licenses Evident. You can raise a concern with us at [email protected] and we will respond, and you retain every right described in Sections 5 and 7 of the Privacy Policy, including deletion.

Subscribe to changes. Email [email protected] with the subject line "Subprocessor notifications" to be added to the notice list.

6. Deletion Across Subprocessors

When we execute an account deletion or partial deletion request, we delete the data from our own systems and instruct each subprocessor to do the same in theirs, within the 30-day window committed in Section 5.4 of the Privacy Policy.

In practice, for the current list:

7. Contact

Subprocessor questions, objections, and notification requests: [email protected]

Vecto Solutions, LLC PO Box 291357, Columbia, SC 29229, United States

8. Change History

The canonical URL of this page is https://vecto-solutions.com/legal/subprocessors/. Use that address wherever a subprocessor list is required.