Sub-processors
Effective date: May 9, 2026
Last updated: May 9, 2026
This page lists the third-party sub-processors that Folio Solutions ("Folio") engages to process personal data on behalf of our customers in connection with the Services. We update this list when sub-processors change.
What is a sub-processor?
A sub-processor is a third party that we use to help operate our Services and that may, in the course of doing so, process personal data on behalf of our customers. We require all sub-processors to provide a level of data protection at least equivalent to what we provide under our Data Processing Addendum.
Scope: managed package vs. business operations
None of the sub-processors listed below are involved in the operation of the Folio managed packages installed in a customer's Salesforce organization. The Folio Jot and Folio Docs managed packages run entirely on the Salesforce platform within the customer's own org, and customer content stored in those packages is not transmitted to any third party by Folio.
The sub-processors listed below are engaged solely to support Folio's own business operations — for example, marketing the website, invoicing and accounting, sales and customer support communications, and source control. They do not access the customer's Salesforce org or the data inside it. Salesforce is included only because it is the platform the managed packages run on; the customer's own agreement with Salesforce governs the data inside their org.
Notification of changes
We provide at least 30 days' notice before authorizing any new sub-processor. Active customers will receive notice by email. To subscribe to sub-processor updates, contact privacy@foliosolutions.net.
Current sub-processors
Infrastructure and platform
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| Salesforce, Inc. (Customer's org) | Underlying platform on which the Folio managed packages operate. The Customer's own Salesforce organization stores all document content and other Customer Data created with the Folio managed packages, and is governed by the Customer's own agreement with Salesforce, Inc. | United States and other regions per Customer's Salesforce instance | salesforce.com/company/privacy |
| Salesforce, Inc. (Folio's own CRM) | Folio uses its own Salesforce organization as its internal CRM to manage prospect, customer, and contact records, opportunities, license records (via the Salesforce License Management Application), and customer-success activities. This is operationally separate from the Customer's Salesforce org. | United States | salesforce.com/company/privacy |
| Cloudflare, Inc. | Website hosting, DNS, and content delivery for foliosolutions.net | United States and global edge network | cloudflare.com/privacypolicy |
Communications
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| EmailOctopus Ltd | Email list management, marketing email delivery, and waitlist communications | United Kingdom | emailoctopus.com/legal/privacy |
| Google LLC (Google Workspace) | Business email (Gmail), calendar, video meetings (Google Meet) including any meeting recordings and transcripts, file storage (Google Drive), and document collaboration (Docs, Sheets, Slides) used for sales, support, customer communications, and internal operations. | United States | policies.google.com/privacy |
| Cal.com, Inc. | Scheduling and calendar booking for sales, onboarding, and support meetings. Processes invitee name, email, and meeting metadata. | United States and European Union | cal.com/privacy |
| Anthropic, PBC | AI-assisted drafting, summarization, and analysis of business and support communications using the Claude assistant. Per Anthropic's commercial terms, customer inputs and outputs are not used to train Anthropic's models. | United States | anthropic.com/legal/privacy |
| Apollo.io (ZenProspect, Inc.) | Sales engagement and prospecting platform used for outbound email, contact data enrichment, and email engagement tracking (opens, clicks, replies). Processes business contact data of prospects (name, business email, phone, job title, company, public profile data) and engagement metadata. | United States | apollo.io/privacy-policy |
Billing and operations
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| Wave Financial Inc. | Bookkeeping and accounting records, including customer billing information | Canada and United States | waveapps.com/privacy-policy |
| Stripe, Inc. | Payment processing for invoices and subscription billing. Stripe acts as Folio's payment processor and handles cardholder data directly; Folio does not store full payment card numbers. | United States | stripe.com/privacy |
| PandaDoc, Inc. | Electronic signature and contract management for order forms, NDAs, and other agreements. Processes signer name, email, IP address, and contract content. | United States | pandadoc.com/privacy-notice |
| iPostal1 (United States Postal Solutions, Inc.) | Virtual mailbox and physical mail handling for Folio's business address. iPostal1 receives, scans envelopes (and, on request, contents), and forwards or shreds physical mail. Incoming mail may incidentally contain personal data (for example, sender names and addresses, contents of correspondence sent to Folio). | United States | ipostal1.com/privacy-policy |
Development and source control
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Source code hosting and issue tracking. Does not process customer-submitted personal data in the ordinary course. | United States | docs.github.com/privacy |
Notes
- The list above reflects the sub-processors used to operate Folio. The customer's own Salesforce organization and any third-party services the customer integrates with Folio are not Folio sub-processors and are governed by the customer's own agreements with those providers.
- Sub-processors who process personal data of EU, UK, or Swiss data subjects in countries without an adequacy decision do so under Standard Contractual Clauses or equivalent transfer mechanisms.
- The location of processing reflects the primary location of operations. Sub-processors may have additional data center locations or may use their own sub-processors. For details, refer to each sub-processor's privacy policy.
Contact
Questions about this list or to request notification of future changes:
Email: privacy@foliosolutions.net