Trust & security
Subprocessors.
Last updated: April 30, 2026.
UnifiedGarage uses third-party services to run the platform. Below is the full list - what each one does, where data lives, and what we send. We notify customers in advance of any change to this list.
Core infrastructure
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase (supabase.com) | Managed PostgreSQL database | All dealership data: customers, deals, ROs, parts, accounting | us-east-1 (AWS) |
| Railway (railway.app) | Backend application hosting | Application logs (no PII), in-flight requests | us-east |
| Vercel (vercel.com) | Front-end hosting + CDN | Static assets, edge cache | Global edge |
| Cloudflare R2 (cloudflare.com) | Object storage | Vehicle photos, document attachments, signed PDFs | Global edge with us-east primary |
| Cloudflare DNS | DNS resolution + DDoS protection | DNS queries (anonymized) | Global anycast |
Communications
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Resend (resend.com) | Transactional email (invitations, password resets, customer notifications, receipts) | Recipient email, message body | us-east-1 (AWS) |
| Twilio (twilio.com) - optional | SMS notifications (inspection approvals, appointment reminders) when enabled by the dealership | Recipient phone number, message body | us-east-1 |
Operations & observability
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Sentry (sentry.io) | Error tracking | Stack traces, PII-scrubbed request context | us-east |
| PostHog (posthog.com) | Product analytics (anonymous, opt-in) | Aggregated usage events; no PII | us-east |
| GitHub (github.com) | Source code, dependency scanning, CI | Source code only - no customer data | us-east |
Payment & billing
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Stripe (stripe.com) | Subscription billing for UnifiedGarage license | Dealership billing contact, payment method (handled by Stripe directly - we never see card numbers) | us-east-1 |
Optional dealer-configured integrations
The following integrations are off by default. They activate only when the dealership opts in - for example, by entering an API key in Settings.
| Provider | Purpose | Activates when… |
|---|---|---|
| QuickBooks Online (Intuit) | Accounting bridge - pushes journal entries to QBO | Dealer connects QBO via OAuth in Settings → Integrations |
| Black Book / Canadian Black Book | Vehicle valuation lookup for trade-in appraisals | Dealer enters API credentials in Settings → Integrations |
| Dealertrack / RouteOne (Cox Automotive) | Credit application submission to lenders | Dealer connects via OAuth in F&I → Lender setup |
Notification of changes
If we add, remove, or replace a subprocessor, we update this page and email the dealership's primary admin contact at least 30 days in advance. To subscribe to subprocessor change notifications even if you're not a customer, email privacy@unifiedgarage.com.
Questions? privacy@unifiedgarage.com.