Sub-processors
Last updated: September 30, 2026.
A sub-processor is a third-party service that QuotWay relies on to run the app, and that may process data on our behalf. When QuotWay processes data about a buyer, the merchant who installed QuotWay is the data controller and QuotWay is the data processor; the services below are our sub-processors.
This list is current as of the date above. It may change as we add, replace, or remove services. When it changes, we update this page and the privacy policy within 30 days, and we notify merchants of material changes (see "Changes to this list" below).
Current sub-processors
| Name | Purpose | Data processed | Region / location |
|---|---|---|---|
| Shopify | App platform, authentication, and store data. QuotWay installs as a Shopify app and reads/writes your Shopify data through Shopify's APIs. | Shop profile, staff identity, customer records, and quote data that flows through Shopify APIs | Global |
| Vercel | Application hosting and serverless functions. | Request metadata and uncaught error events | United States |
| Neon | PostgreSQL database. Stores QuotWay's application data. | All quote, settings, and account data | US East (United States) |
| Vercel Blob | File storage for buyer and message attachments and generated PDFs. | Attachment file contents and PDF documents | United States |
| toSend | Transactional email delivery (primary). | Recipient email address, email content, and delivery status | United States |
| AWS SES | Transactional email delivery (backup transport; primary remains toSend). | Same as toSend: recipient email address, email content, and delivery status | United States |
| Sentry | Error monitoring and debugging. | Stack traces and request context, with PII fields scrubbed before upload | United States |
Regions reflect each provider's primary location; confirm against your provider settings before relying on this for compliance.
The QuotWay API and outbound webhooks run on the infrastructure listed above; they don't add any sub-processor.
Integration recipients you choose are not sub-processors
On the Enterprise plan, a merchant can connect QuotWay to other systems using API keys and webhook endpoints it configures. Examples include the merchant's ERP or CRM, a data warehouse, an integration platform such as Zapier, or an agency. When a merchant sends data to one of these systems:
- The transfer is made on the merchant's instructions.
- The recipient is the merchant's own processor or recipient. It is not a QuotWay sub-processor, and it isn't listed on this page.
- The merchant is responsible for its agreements with that recipient.
See our API Terms of Use and Privacy policy.
Changes to this list
We may add, replace, or remove a sub-processor as the service evolves. When we make a change:
- We update this page and the privacy policy within 30 days of the change.
- We notify merchants of material changes through the in-app banner.
Continued use of QuotWay after a change takes effect constitutes acceptance of the updated list.
Contact
Questions about this list or our data practices: privacy@quotway.com.