Privacy and service providers
Subprocessor List
H4 Legacy Holdings, LLC, doing business as AssociationOps360
Effective September 11, 2026
This list identifies third parties approved to process Customer Personal Data on behalf of AssociationOps360 for the service. It supplements the Data Processing Addendum. A provider is listed only after selection; placeholder integrations are not treated as subprocessors.
Public website update, October 11, 2026: Vercel hosts the public marketing website and provides cookie-less aggregate public-page analytics. That collection excludes form fields, URL parameters, sign-in and trial-intake pages, and customer operational records. This public-site analytics use is separate from the secured-service processing described below. See the Privacy Policy and Cookie Policy for the analytics data and browser opt-out controls.
1. Approved direct subprocessor
- Provider
- Render Services, Inc.
- Purpose
- Approved staging infrastructure provider for application hosting, network delivery, persistent storage, service logs, and related platform operations actually configured in the Render environment.
- Data categories
- Account and authorized-user information; customer-controlled operational records; attachments when stored through the hosted service; session, access, diagnostic, security, and service-log information; and other Customer Personal Data processed by the deployed application.
- Data subjects
- Customer personnel, authorized users, requesters, residents, board members, vendors, contractors, business contacts, and other individuals represented in customer-controlled operational records.
- Processing location
- Planned staging region: Virginia, United States. The selected region and each attached datastore or persistent disk must be verified in the Render dashboard before hosted certification.
- Status
- Approved for staging. Production use remains conditioned on verification of the deployed service, storage, network, backup, access, retention, and recovery configuration.
- Provider terms
- Render Terms of Service, Render Data Processing Addendum, and Render’s current authorized-subprocessor list and trust materials apply to AssociationOps360’s use of Render.
2. Configured private-staging identity provider
- Provider
- Amazon Web Services, Inc. — Amazon Cognito
- Purpose
- Private-staging identity directory and application client for invitation-only account sign-in, session tokens, account recovery, and multi-factor authentication when the application integration is completed.
- Data scope
- The private-staging user pool and client are configured, but no end-user account has been created and no Customer Personal Data has been sent through Cognito. When staging lifecycle testing begins, Cognito will process the synthetic account email, authentication and token data, security events, and service diagnostics needed for identity.
- Processing location
- United States (N. Virginia) AWS Region.
- Status
- Configured for private staging only: email sign-in, public self-registration disabled, and staging-only callback/sign-out addresses. Not integrated with the application, not processing Customer Personal Data, and not approved for production use.
- Provider terms
- AWS Service Terms, Privacy Notice, and data-processing materials were reviewed for the configured private-staging boundary. AWS terms incorporate the AWS Data Processing Addendum when AWS Services process Customer Data; production use still requires the final implementation and legal/privacy review.
3. Provider-chain transparency
Render engages its own authorized subprocessors as described in Render’s published DPA and trust materials. Those providers form part of Render’s service-delivery chain; AssociationOps360 does not restate that dynamic list as if it were independently selected. Customers may review Render’s current list through Render’s official trust materials.
AssociationOps360 remains responsible for its obligations under the AssociationOps360 DPA and will monitor material notices from Render that affect Customer Personal Data.
4. Providers not yet approved
No separate email, payment, object-storage, monitoring, backup, support, analytics, advertising, push-notification, mapping, or AI provider is approved by this list. Cognito is configured only for the private-staging identity boundary described above; it is not yet integrated with the application. Configuration templates may mention possible providers, but a placeholder name or disabled environment variable does not authorize processing.
Before any such provider receives Customer Personal Data, AssociationOps360 must approve the use, document the purpose and data scope, review applicable privacy and security terms, configure the service, test the actual data flow, update this list and the cookie inventory when applicable, and complete any required customer notice.
5. New-subprocessor notice and objection
AssociationOps360 will provide notice of a new direct subprocessor at least 15 days before the provider begins processing Customer Personal Data when required by the DPA. A customer may submit a reasonable, documented data-protection objection during that period. The parties will work in good faith on a commercially reasonable resolution; the remedies in the DPA apply if no suitable resolution is available.
6. Contact and change record
Questions or objections may be sent to support@associationops360.com with the customer, affected service, provider, and data-protection basis. Do not include passwords or unrelated sensitive information.
The effective date above identifies this version. Material additions, removals, purpose changes, or processing-location changes will be recorded in an updated version and communicated as required by the DPA.