Subprocessors and Service Providers
Last updated: November 3, 2026
FormSignal LLC uses the providers below to operate W9Finder, deliver service communications, process subscription payments, and understand use of our public website.
This page identifies the services each provider supplies, the information involved, and relevant processing-location information.
"Customer Data" refers to information processed on our customers' behalf, including client and vendor records, uploaded documents, and related workflow information, as described in our Terms of Service.
Some providers support both Customer Data processing and FormSignal's own account administration or business operations. Billing and public-website analytics are described separately below.
Our Privacy Policy explains how we handle personal information: https://formsignal.co/privacy
Providers supporting W9Finder
The following providers support application hosting, document handling, communications, and service reliability.
| Provider | Purpose and relationship | Information involved | Processing location |
|---|---|---|---|
| Laravel Cloud, provided by Laravel Holdings Inc. | Application hosting, database services, background jobs, scheduled tasks, and related infrastructure. See Laravel's terms: https://laravel.com/cloud/legal/terms | Account and organization information; client and vendor records; taxpayer identification fields; document upload and download processing; scanner processing; and related session, request, review, audit, delivery, queue, log, and backup records. | Application region: US East (Ohio). Database and backup region: US East (Ohio), through Neon as described below. Additional provider processing is subject to Laravel's applicable agreements and infrastructure arrangements. |
| Amazon Web Services, Inc. (AWS) | Amazon S3 for private document and export storage; AWS Key Management Service (KMS) for cryptographic key management and operations used by the application's encryption system. AWS also supplies underlying infrastructure to Laravel Cloud. KMS information: https://docs.aws.amazon.com/kms/latest/developerguide/data-keys.html | S3 processes uploaded documents, generated exports, and associated storage metadata. Documents and certain exports may contain full taxpayer identification numbers. KMS generates and decrypts the per-record data keys and records operation metadata; the application encrypts each TIN itself with AES-256-GCM, so KMS never receives a TIN. | S3 region: us-east-2 (US East, Ohio). KMS region: us-east-2. Prior file versions are retained in the same bucket; no cross-region replication is configured. |
| Postmark, provided by AC PM, LLC | Delivery of account messages, customer-directed document requests and reminders, requested scanner summaries, and approved product emails. Postmark also supplies delivery and suppression events. Provider terms: https://postmarkapp.com/terms-of-service | Sender and recipient information, reply-to details, email subjects and bodies, links included in messages, delivery records, bounce and complaint information, and unsubscribe or suppression records where applicable. Message content can include firm or client names and time-limited account or upload links. | Postmark describes hosting at a data center near Chicago and AWS. Its terms also contemplate processing in the United States and other countries. Hosting information: https://postmarkapp.com/support/article/is-postmark-secure-and-redundant |
| Sentry, provided by Functional Software, Inc. | Application error monitoring and investigation. Provider information: https://sentry.io/privacy/ | Diagnostic events such as error descriptions, stack traces, release or component information, and permitted request context, subject to the filtering described under "Information excluded from email and diagnostics." | Event-storage region: United States. Other processing follows Sentry's privacy notice and data processing addendum. |
| Neon, Inc., through Laravel Cloud | The serverless PostgreSQL service that powers Laravel Cloud's database offering, including point-in-time recovery for the previous 14 days. Laravel's description: https://laravel.com/cloud/docs/resources/databases/postgres | The application database: the records listed for Laravel Cloud above, excluding stored files, which are held in Amazon S3. | us-east-2 (US East, Ohio), matching the application cluster. |
| Cloudflare, Inc., through Laravel Cloud | Network delivery and security, including traffic proxying and protection against abusive requests. Laravel describes this infrastructure relationship here: https://laravel.com/blog/laravel-cloud-security-defaults-behind-every-deploy | Traffic routed through Cloudflare, including IP addresses, requested URLs, headers, and request and response content handled by its proxy and security services. All browser traffic to formsignal.co and app.formsignal.co passes through this layer, including vendor uploads and firm-side document and export downloads, because the application streams those files itself and does not hand browsers direct storage links. | Global network. Any regional restrictions depend on the services and settings actually enabled. Cloudflare describes its default processing here: https://developers.cloudflare.com/data-localization/regional-services/http-requests/ |
Laravel maintains additional provider and security information in its Trust Center: https://trust.laravel.com/
Billing and public-website analytics
These providers support FormSignal's subscription administration and public website. Their roles and data flows differ from the processing of vendor records within a customer's W9Finder account.
| Provider | Purpose | Information involved | Processing location |
|---|---|---|---|
| Stripe, LLC, together with any additional Stripe entity identified in the applicable service terms | Subscription checkout, billing, invoices, payment-method management, refunds, and payment-related security. Stripe's contracting entities are described here: https://stripe.com/legal/legal-process-guide | Billing contact information, firm billing details, subscription and transaction information, payment details supplied through Stripe's hosted services, and related device or fraud-prevention information. | United States and other countries described in Stripe's privacy disclosures. Stripe may act as a controller for some processing activities. Details: https://stripe.com/privacy |
| Google LLC, through Google Analytics 4 | Measurement of visits and selected interactions on public marketing pages. | Configured page and event information, browser and device information, cookie or similar identifiers, and location information derived at collection time. Google explains its collection practices here: https://support.google.com/analytics/answer/6004245 and https://support.google.com/analytics/answer/11598602 | International processing through Google's infrastructure and subprocessors. Google's processing terms describe permitted processing locations: https://business.safety.google/adsprocessorterms/ |
Information excluded from email and diagnostics
We do not include uploaded W-9 documents or full taxpayer identification numbers in emails sent through Postmark. Scanner summaries contain aggregate results rather than uploaded vendor rows.
Our error-reporting configuration is designed to exclude document contents, full TINs, passwords, session credentials, and private-link tokens from diagnostic events sent to Sentry.
Filtering happens in the application before an event is sent. Request bodies are never collected. The event's user record is removed, so no account identity or IP address is attached by the application. Query strings and fragments are stripped from URLs, Livewire request data is reduced to component and method names, SQL bindings are never collected, and exception messages, breadcrumbs, tags, stack-frame variables, request metadata, and extra context pass through a redactor that masks TIN-like values, tokens, credentials, private paths, filenames, and email addresses in query strings. Performance tracing is sampled at zero in production. Sentry's own server-side data scrubbing is also enabled, and Sentry's setting that prevents storing IP addresses is on.
We use Google Analytics on public marketing pages. It is not enabled on sign-in pages, vendor upload pages, or ordinary pages inside the signed-in application. Two signed-in pages load it only to record a conversion event: the billing settings page and the first dashboard view after registration. The application then forces a full page load before any other signed-in page is shown, which unloads the Google tag.
Our analytics configuration excludes uploaded documents, vendor rows, TINs, email addresses, private-link tokens, and internal customer account identifiers.
Automatic page-view collection is turned off. The site sends one page view for each public marketing page that carries the tag (the Privacy Policy, Terms of Service and Subprocessors pages do not), built from the page path only, without query strings, fragments, or the referring page, and loads the Google tag script with the browser referrer suppressed. Custom events carry only a short list of approved fields. Google Analytics event data is retained for 2 months. No Google Ads tag is configured.
Processing locations
The location information above distinguishes configured storage regions from other processing, such as network routing, email delivery, payment processing, diagnostics, and provider support.
A United States application or storage region does not mean that every provider processes all information exclusively in the United States.
Provider disclosures describe their services generally. FormSignal-specific regional commitments depend on the applicable agreements and the configuration used for our services.
Document review
Uploaded W-9 documents are reviewed by people at the requesting firm. W9Finder does not send those documents to an AI or automated extraction provider.
The production parser mode is the manual-review mode, and no external document-processing provider is active.
Provider changes
We maintain this page as our provider arrangements change.
For additions or replacements of subprocessors that will process Customer Data, we provide notices and handle objections in accordance with the applicable customer agreement.
Our Terms of Service describe the standard process: https://formsignal.co/terms
Updating this page does not reduce FormSignal's obligations under an applicable customer agreement.
Contact
Questions about our providers or their processing of information:
hello@formsignal.co
FormSignal LLC
725 River Rd, Suite 32, Edgewater, NJ 07020
United States
Email: hello@formsignal.co