Subprocessor List
Version 1.0 — Effective August 3, 2026 (posted July 4, 2026)
Oystercatcher, LLC, a Connecticut limited liability company ("Oystercatcher," "we," "our," or "us"), engages the third-party service providers listed on this page ("Subprocessors") to process personal data on our behalf in connection with providing the Oystercatcher platform and related services (the "Service"). This page is incorporated by reference into our Data Processing Agreement ("DPA") and constitutes the current, authorized list of Subprocessors for purposes of the DPA.
Each Subprocessor is bound by a written agreement that imposes data protection obligations no less protective than those in our DPA, including confidentiality and security requirements appropriate to the nature of the data processed. We remain responsible to our customers for the performance of each Subprocessor's obligations.
Current Subprocessors
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, and transactional email delivery (SES) | All service data, including account data and customer content | United States |
| Stripe, Inc. | Payment processing and subscription billing | Billing contact and payment data | United States |
| Anthropic, PBC | AI language-model processing (natural-language search interpretation, AI research features, including live web searches performed via Anthropic's server-side web-search tool) | Customer search descriptions; healthcare-provider professional data, including queries sent to web search | United States |
| OpenAI, LLC | Text-embedding generation for semantic search | Derived profile text and search criteria | United States |
| Google LLC | Single sign-on (OAuth); business-listing enrichment (Places API) | Account identifiers; practice-location data | United States |
| Microsoft Corporation | Single sign-on (Entra ID OAuth) | Account identifiers | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring | Technical/diagnostic data, which may include user identifiers | United States |
| LogRocket, Inc. | In-application session replay for support and product improvement | User identity (name, email) and in-app activity | United States |
| Cloudflare, Inc. | DNS, CDN, marketing-site hosting, and cookieless aggregate site analytics | Technical/network data | Global (US-controlled) |
Customer-Directed Integrations
The Service offers optional integrations that a customer may choose to connect, such as Salesforce (CRM synchronization). These providers operate only when, and to the extent that, a customer affirmatively connects them, and any transfer of personal data to such a provider occurs at the customer's direction. Customer-directed integrations are governed by the customer's own agreement with the relevant provider and are not Subprocessors of Oystercatcher for purposes of the DPA.
Updates to This List
We will provide at least 30 days' advance notice before authorizing any new Subprocessor to process personal data by updating this page and by emailing customers who have subscribed to subprocessor-change notifications. To subscribe, email [email protected] with the subject line "Subscribe: subprocessor updates." Customers may object to a new Subprocessor as described in the DPA.
Change Log
- July 4, 2026 — Initial publication.
Contact
Questions about this Subprocessor List may be directed to [email protected].
Oystercatcher, LLC
Email: [email protected]