Subprocessors

Last updated: 2026-08-11

Achieve IT uses the third-party providers listed below to help deliver the Ultimate Email Management System. We maintain this page so our customers can see exactly who we rely on and what they do with customer data.

Changes to this list: we will notify customers at least 30 days before engaging a new subprocessor, and you can object per our Data Processing Addendum §6.3.

Core infrastructure

A note on encryption keys: your stored mailbox credentials are protected by envelope encryption — each credential has its own data key, and those keys are wrapped by a master key. That master key is currently held in our hosting platform's encrypted configuration store, which is why no separate key-management provider appears above. We plan to move it to a dedicated key-management service (AWS KMS) before our first non-pilot client, and we will add that provider to this list when we do.

Identity and authentication

Multi-factor authentication is not handled by Clerk — Achieve IT runs its own TOTP second factor, and the TOTP secrets never leave our database.

AI model provider

On the standard service tiers (Solo, Team, Business, Managed — and the retired Starter, Growth, and Scale plans), customer content sent to MiniMax for inference may be used by MiniMax to train its own models per the provider's published terms. Achieve IT does not control that policy.

If a contractual no-training guarantee is required, Achieve IT offers a no-training AI tier that routes inference to an alternate provider (e.g., a self-hosted or zero-retention API endpoint) under a written addendum. Pricing is custom; contact [email protected].

Embeddings and search

Embeddings are numeric representations of text, not the text itself, but the source text is transmitted to Voyage in order to produce them. Voyage does not receive your stored credentials.

Outbound service email

Your customers' replies are sent through your mail provider (Gmail, Microsoft 365, or your own SMTP server), never through Resend. Resend only carries mail that Achieve IT itself sends to you.

Payments and financial

Other operational

Google Analytics runs with ad personalization and Google Signals switched off. It receives page addresses stripped of record identifiers and query strings, plus the standard device and approximate-location signals any web analytics tool collects. It is not loaded on the admin console, and it never receives email content or knowledge-base content. The client portal reports to a separate Analytics property that is not linked to Google Ads; the marketing-site property is linked, so browsing achieveit.ca also sends a non-personalized remarketing ping. See the Privacy Policy §9.

Data each subprocessor can access

For transparency, here is what each subprocessor can see. No subprocessor has access to the full picture; each sees only what it needs for its function.

Not subprocessors (for clarity)

Some services are NOT subprocessors under this framework because they don't process personal data on our behalf:

• GitHub: where we host our code. Customer data does not live in GitHub.
• Google Workspace: our own internal email and docs. Our business operations, not customer data processing.
• Linear: our own internal project management.

These are vendors to Achieve IT and are not listed as subprocessors because they do not process customer personal information.

Historical subprocessor changes

We log every addition, removal, or material change to this list so customers have an auditable history.

(This table will grow over time as we add or swap subprocessors.)

Questions

• General privacy questions: [email protected]
• Data-processing / DPA questions: [email protected]
• Security researcher disclosures: [email protected]