Authorized Subprocessors & Cloud Infrastructure List
Effective Date: October 25, 2026 • Operated by Real Builds LLC (d/b/a VendorsCert™ and PactIQ™). SOC 2, ISO 27001, and PCI-DSS certifications belong strictly to the underlying infrastructure providers listed below.
| Subprocessor Entity | Scope of Processing | Data Residency | Provider Security Posture |
|---|---|---|---|
| 1. Google Cloud Platform & Firebase (Google LLC) | Primary cloud hosting, Firestore tenant-isolated database, Firebase Authentication (OAuth 2.0 / TOTP), and AES-256 encrypted object storage. | United States (us-central1 / us-west1) | SOC 1/2/3, ISO 27001 |
| 2. Google Cloud Vertex AI / Gemini Enterprise API | Zero-retention B2B OCR extraction of ACORD 25 limits and ISO endorsement form numbers (Zero model training; DLP redaction active). | United States | Enterprise B2B Data Governance • Zero Training |
| 3. Stripe, Inc. | External PCI-DSS Level 1 subscription billing and checkout processing. Real Builds LLC never stores raw payment card numbers (PANs). | United States | PCI-DSS Level 1 Service Provider |
| 4. Transactional Email Relay (Google Workspace / Postmark) | TLS-encrypted delivery of tokenized COI intake links, multi-signer e-signature requests, and automated 1/3/7-day compliance reminders. | United States | TLS 1.3 + DKIM / SPF / DMARC Enforced |
| 5. Telnyx LLC (ITU-T T.38 Cloud Fax & Opt-In Telecom Gateway) | Point-to-point encrypted T.38 facsimile transmission of COI binders/subcontracts and strictly opt-in transactional SMS signing/compliance alerts (Line: +1-425-954-7371). Zero marketing or ad-network sharing. | United States | SOC 2 Type II • HIPAA & PCI-DSS Telecom Carrier |
Zero-SMS Login MFA & Strict Opt-In Telecom Isolation (Telnyx LLC): Workspace login authentication relies strictly on OAuth 2.0 and RFC 6238 TOTP Authenticator Apps (eliminating vulnerable SS7/SMS login OTP interception). Optional ITU-T T.38 Cloud Fax transmissions and separate opt-in transactional SMS signing alerts route exclusively through dedicated United States point-to-point telecom trunks operated by Telnyx LLC, with zero third-party marketing aggregator exposure.