Sub-processors
Effective date: May 13, 2026
Last updated: September 17, 2026
This page lists the third-party service providers that Folio Solutions LLC ("Folio") uses to process personal data in connection with the Services. It includes sub-processors under our Data Processing Addendum, as well as service providers that support Folio's own business operations and process Account Data (as defined in the DPA), which Folio handles as an independent controller under our Privacy Policy. We update this list when sub-processors change.
What is a sub-processor?
A sub-processor is a third party that we use to help operate our Services and that may, in the course of doing so, process personal data on behalf of our customers. We require sub-processors that process Customer Personal Data to provide a level of data protection at least equivalent to what we provide under our Data Processing Addendum.
Scope: managed package vs. business operations
Other than Salesforce as the underlying platform, none of the service providers listed below are involved in the operation of the Folio Docs managed package installed in a customer's Salesforce organization. The Folio Docs managed package runs entirely on the Salesforce platform within the customer's own org, and customer content stored in the package is not transmitted to any third party by Folio.
The other service providers listed below are engaged solely to support Folio's own business operations — for example, marketing the website, invoicing and accounting, sales and customer support communications, and source control. Other than Salesforce in its role as the customer's platform provider, they do not access the customer's Salesforce org or the data inside it. Salesforce appears twice below: as the platform the managed package runs on, where the customer's own agreement with Salesforce governs the data inside their org, and as the platform for Folio's own CRM and partner operations.
Notification of changes
For sub-processors that process Customer Personal Data under our Data Processing Addendum, we provide at least 30 days' notice before authorizing a new sub-processor, including by email to active customers. Service providers that process only Account Data may be added or changed at any time, and we update this page when that happens. To subscribe to sub-processor updates, contact privacy@foliosolutions.net.
Current sub-processors
Infrastructure and platform
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| Salesforce, Inc. (Customer's org) | Underlying platform on which the Folio managed packages operate. The Customer's own Salesforce organization stores all document content and other Customer Data created with the Folio managed packages, and is governed by the Customer's own agreement with Salesforce, Inc. | United States and other regions per Customer's Salesforce instance | salesforce.com/company/privacy |
| Salesforce, Inc. (Folio's own CRM) | Folio uses its own Salesforce organization as its internal CRM to manage prospect, customer, and contact records, opportunities, license records (via the Salesforce License Management Application), and customer-success activities. This is operationally separate from the Customer's Salesforce org. This includes, where applicable, order, offer, and subscription records for purchases made through the Salesforce AgentExchange Go-To-Market App. | United States | salesforce.com/company/privacy |
| Cloudflare, Inc. | Website hosting, DNS, and content delivery for foliosolutions.net | United States and global edge network | cloudflare.com/privacypolicy |
Communications
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| EmailOctopus Ltd | Email list management, marketing email delivery, and waitlist communications | United Kingdom | emailoctopus.com/legal/privacy |
| Google LLC (Google Workspace) | Business email (Gmail), calendar, video meetings (Google Meet) including any meeting recordings and transcripts, file storage (Google Drive), and document collaboration (Docs, Sheets, Slides) used for sales, support, customer communications, and internal operations. | United States | policies.google.com/privacy |
| Cal.com, Inc. | Scheduling and calendar booking for sales, onboarding, and support meetings. Processes invitee name, email, and meeting metadata. | United States and European Union | cal.com/privacy |
| Anthropic, PBC | AI-assisted drafting, summarization, and analysis of business and support communications using the Claude assistant. Per Anthropic's commercial terms, customer inputs and outputs are not used to train Anthropic's models. | United States | anthropic.com/legal/privacy |
| Apollo.io (ZenProspect, Inc.) | Sales engagement and prospecting platform used for outbound email, contact data enrichment, and email engagement tracking (opens, clicks, replies). Processes business contact data of prospects (name, business email, phone, job title, company, public profile data) and engagement metadata. | United States | apollo.io/privacy-policy |
| Tally BV | Hosts the embedded popup forms on the Folio website — the Contact Sales form (triggered from header, footer, and other CTAs) and the Get Support form (triggered from Help Center pages). Collects whatever data the visitor enters in those forms (typically name, email, company, message), plus standard form-submission metadata. | European Union (Belgium) | tally.so/help/privacy-policy |
| Make.com (Celonis SE) | Workflow automation that processes form submissions from the Contact Sales and Get Support forms — routing them to Folio's CRM, support inbox, and notification channels. Touches the same submitted data Tally collects (name, email, company, message) in transit. | European Union (Czech Republic) and United States | make.com/en/privacy-notice |
Billing and operations
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| Wave Financial Inc. | Bookkeeping and accounting records, including customer billing information | Canada and United States | waveapps.com/privacy-policy |
| Stripe, Inc. | Payment processing in two separate contexts. Direct purchases from Folio: Stripe processes invoices and subscription billing as Folio's payment processor. Purchases through the Salesforce AgentExchange: Stripe is the payment processor Salesforce designates behind AgentExchange Checkout and the AgentExchange Go-To-Market App, and Salesforce requires partners like Folio to open and maintain their own Stripe account linked to their listings. In that flow, Stripe collects the customer's payment details, processes the charge, maintains subscription and trial state, and remits payouts to Folio's business bank account; the pricing plans Folio configures in the Salesforce Partner Console are synced to Stripe, and transaction, subscription, and payout records sync back into Folio's own Salesforce org. Salesforce designates the processor for marketplace transactions and may change it. In both contexts Stripe handles cardholder data directly and Folio does not store or receive full payment card numbers. | United States | stripe.com/privacy |
| PandaDoc, Inc. | Electronic signature and contract management for order forms, NDAs, and other agreements. Processes signer name, email, IP address, and contract content. | United States | pandadoc.com/privacy-notice |
| iPostal1 (United States Postal Solutions, Inc.) | Virtual mailbox and physical mail handling for Folio's business address. iPostal1 receives, scans envelopes (and, on request, contents), and forwards or shreds physical mail. Incoming mail may incidentally contain personal data (for example, sender names and addresses, contents of correspondence sent to Folio). | United States | ipostal1.com/privacy-policy |
Development and source control
| Sub-processor | Purpose | Location of processing | Privacy policy |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Source code hosting and issue tracking. Does not process customer-submitted personal data in the ordinary course. | United States | docs.github.com/privacy |
Notes
- The list above reflects the sub-processors used to operate Folio. The customer's own Salesforce organization and any third-party services the customer integrates with Folio are not Folio sub-processors and are governed by the customer's own agreements with those providers.
- Sub-processors who process personal data of EU, UK, or Swiss data subjects in countries without an adequacy decision do so under Standard Contractual Clauses or equivalent transfer mechanisms.
- The location of processing reflects the primary location of operations. Sub-processors may have additional data center locations or may use their own sub-processors. For details, refer to each sub-processor's privacy policy.
- Salesforce operates the AgentExchange and the AgentExchange Go-To-Market App, including processing of purchases and payments made through them, as an independent party under its own terms and privacy statement. In that role, Salesforce is not a Folio sub-processor. Payments made through those channels are processed by the payment processor Salesforce designates for the marketplace — currently Stripe — under Salesforce's arrangements with that processor and the processor's own terms. Folio is listed above as engaging Stripe because Folio holds the Stripe account that receives those payouts.
Contact
Questions about this list or to request notification of future changes:
Email: privacy@foliosolutions.net