Sub-processors — Vasthaul

The list

Provider	Where	What it does for us
Supabase	Canada (ca-central-1)	The database, the file storage the documents and photographs sit in, and sign-in. This is where a carrier’s records live.
Cloudflare	Its global network; the company is in the United States	Runs the office application, the driver app and this site, and takes in the rate confirmations forwarded to a carrier’s intake address. Everything a person does passes through it. It holds no copy of the carrier’s records — what it keeps is the platform’s own log of the requests.
OneProvider (api.oneprovider.dev), and OpenAI behind it	Outside Canada	The document reader, and the one model call behind Vast. OneProvider is the gateway; the model it is asked for is OpenAI’s GPT‑5.6 Terra, and it is named here because a sub-processor page that says “a model provider” names nobody. A rate confirmation, receipt or delivery document goes whole — the file itself, not an extract — and comes back as a draft a person checks. A sentence typed or spoken to Vast goes as that sentence and nothing else: no row of the carrier’s database is ever sent, and all that comes back is the name of a report to run, a sentence with no figure in it, or the name of one thing to offer to do.
Resend	United States	Sends email: sign-in codes, invoices with their paperwork, settlement statements, the morning briefing.
Stripe	United States	Subscription billing for the carrier’s plan. Card numbers go to Stripe directly; we never see them.
Google	United States	“Continue with Google”, for the people who choose to sign in that way. Google is told a sign-in happened and hands back the name, email address and picture on that account. On a deployment where the 3D fleet map is turned on, the browser also fetches Google’s map tiles for the area the map is looking at; nothing about a driver or a load is sent with that request.
Apple	United States	“Sign in with Apple” in the driver app, for the drivers who choose it. Apple is told a sign-in happened and hands back the name and the email address — or the relay address — on that Apple account.
Twilio	United States	Sends the one-time code to office users who set up a phone as their second factor, and — only to a driver who has turned texts on in the driver app — the five load and pay messages the text message policy describes. Nothing is texted to a customer, a broker or a shipper.
Geoapify (OpenStreetMap data)	Germany	Turns a stop’s street address into a coordinate and measures the road distance between stops, so a load’s miles are a routed figure and not a typed one. It receives facility addresses; it is never sent a driver’s name, a phone number or a position from a phone.
HERE Technologies — only on a deployment that routes with it	Netherlands	The same job as Geoapify, on a deployment configured to use HERE instead. A looked-up coordinate or a routed line from HERE is kept for at most thirty days and then looked up again, which is what HERE’s terms allow.
Apple, Google or Mozilla — whichever made the phone or the browser	United States	Carries a push notification to the device. The message is encrypted to that device before it leaves us, so the service delivers it without being able to read it.

Supabase
Where
Canada (ca-central-1)
What it does for us
The database, the file storage the documents and photographs sit in, and sign-in. This is where a carrier’s records live.
Cloudflare
Where
Its global network; the company is in the United States
What it does for us
Runs the office application, the driver app and this site, and takes in the rate confirmations forwarded to a carrier’s intake address. Everything a person does passes through it. It holds no copy of the carrier’s records — what it keeps is the platform’s own log of the requests.
OneProvider (api.oneprovider.dev), and OpenAI behind it
Where
Outside Canada
What it does for us
The document reader, and the one model call behind Vast. OneProvider is the gateway; the model it is asked for is OpenAI’s GPT‑5.6 Terra, and it is named here because a sub-processor page that says “a model provider” names nobody. A rate confirmation, receipt or delivery document goes whole — the file itself, not an extract — and comes back as a draft a person checks. A sentence typed or spoken to Vast goes as that sentence and nothing else: no row of the carrier’s database is ever sent, and all that comes back is the name of a report to run, a sentence with no figure in it, or the name of one thing to offer to do.
Resend
Where
United States
What it does for us
Sends email: sign-in codes, invoices with their paperwork, settlement statements, the morning briefing.
Stripe
Where
United States
What it does for us
Subscription billing for the carrier’s plan. Card numbers go to Stripe directly; we never see them.
Google
Where
United States
What it does for us
“Continue with Google”, for the people who choose to sign in that way. Google is told a sign-in happened and hands back the name, email address and picture on that account. On a deployment where the 3D fleet map is turned on, the browser also fetches Google’s map tiles for the area the map is looking at; nothing about a driver or a load is sent with that request.
Apple
Where
United States
What it does for us
“Sign in with Apple” in the driver app, for the drivers who choose it. Apple is told a sign-in happened and hands back the name and the email address — or the relay address — on that Apple account.
Twilio
Where
United States
What it does for us
Sends the one-time code to office users who set up a phone as their second factor, and — only to a driver who has turned texts on in the driver app — the five load and pay messages the text message policy describes. Nothing is texted to a customer, a broker or a shipper.
Geoapify (OpenStreetMap data)
Where
Germany
What it does for us
Turns a stop’s street address into a coordinate and measures the road distance between stops, so a load’s miles are a routed figure and not a typed one. It receives facility addresses; it is never sent a driver’s name, a phone number or a position from a phone.
HERE Technologies — only on a deployment that routes with it
Where
Netherlands
What it does for us
The same job as Geoapify, on a deployment configured to use HERE instead. A looked-up coordinate or a routed line from HERE is kept for at most thirty days and then looked up again, which is what HERE’s terms allow.
Apple, Google or Mozilla — whichever made the phone or the browser
Where
United States
What it does for us
Carries a push notification to the device. The message is encrypted to that device before it leaves us, so the service delivers it without being able to read it.

Each provider is engaged under a written agreement that binds it to protections no weaker than our own, and is used only for the job named. The database and the files in it do not leave Canada; the providers outside it receive what their job needs and no more.

Not on this list: the accounts you connect yourself

A carrier that connects Samsara, Motive, Geotab or EROAD connects its own account, on a credential it minted itself and a contract it signed itself. We read that carrier’s own vehicles as the carrier and send the provider nothing about a driver it does not already hold, so it is the carrier’s provider and not ours. The positions we read back are deleted after ninety days.

The same holds for the rest of what a carrier can connect, and none of it is connected until the carrier does it:

QuickBooks Online (Intuit, United States): The carrier’s own company file, reached by the carrier’s own sign-in. Invoices, payments and the customer names on them go across; nothing about a driver does, and nothing is read back into the carrier’s books here.
123Loadboard, DAT, Truckstop: The carrier’s own load-board subscription, reached with the carrier’s own credential and governed by that board’s terms. What the carrier posts goes to the board; what the board shows is the board’s.
Other accounts on the marketplace: A load or a truck the carrier posts on the marketplace inside the product is shown to the other accounts looking at it — the lane, the equipment, the dates and the contact the carrier chose to put on the posting. They are other customers of ours, not our sub-processors, and they contract with the carrier directly.

When this list changes

A carrier is told thirty days before a provider is added, in the product and by email to the owner. A carrier that objects on reasonable grounds, and cannot be accommodated, may end its agreement without penalty. The date at the top of this page is the date it last changed.