Request access

Legal

Subprocessors

Last updated Oct 5, 2026

This page lists subprocessors used by TKO SOLUTIONS L.L.C (doing business as "Trac") to deliver the Services. A subprocessor is a third party engaged by Trac to process customer personal data on Trac's behalf.

Scope

This list is intended for transparency and due diligence support. Specific processing terms are governed by the applicable customer agreement and DPA. This is a draft legal-content baseline and should be validated by counsel before publishing as a final customer-facing commitment.

Current subprocessors

Amazon Web Services (AWS)

  • Purpose: Cloud hosting, compute, storage, networking, and security operations.
  • Data categories: Account identifiers, service configuration data, customer application data, logs, and backups.
  • Region(s): Primarily United States (with region selection based on service environment and customer configuration). Data at rest — databases, documents, backups, and logs — is stored in the United States. AI inference requests are processed by Amazon Bedrock, which may route an individual request to another commercial AWS region for capacity; Bedrock does not store request or response content for the models used, so no customer content is retained outside the United States.
  • Transfer mechanism: Contractual controls and applicable transfer safeguards.

Plaid

  • Purpose: Connecting the bank and brokerage accounts a customer chooses to link, and retrieving their account, holdings, transaction, liability and statement data.
  • Data categories: Credentials a customer enters to authorize a link to their institution, and the data returned for the accounts the customer links: account details including account and routing numbers, investment holdings, investment and other transactions, liabilities, and account statement documents.
  • Region(s): To be confirmed.
  • Transfer mechanism: To be confirmed.

OpenAI

  • Purpose: Voice features: transcribing voice messages and live meeting segments to text, and converting text to speech for the optional read-aloud feature.
  • Data categories: Customer voice audio and the resulting transcripts, and the text of Traci's replies submitted for read-aloud, which can contain portfolio financial data.
  • Region(s): To be confirmed.
  • Transfer mechanism: To be confirmed.

PostHog

  • Purpose: Product analytics.
  • Data categories: Usage events tied to a user identifier, along with the user's given name, family name, username (which can be an email address) and role, and the portfolio identifier.
  • Region(s): To be confirmed.
  • Transfer mechanism: To be confirmed.

Asana

  • Purpose: Internal operational and support ticketing, including tickets filed automatically when the customer-facing service logs an error.
  • Data categories: Portfolio and user identifiers and the free-text subject and body on support requests, and sample customer-facing error log lines quoted in automatically filed tickets, which may contain personal data.
  • Region(s): To be confirmed.
  • Transfer mechanism: To be confirmed.

Google

  • Purpose: Operating the Google Drive, Docs, Sheets and Slides integration a customer connects: copying files a customer uploads, including files attached in conversations, into a Google Drive folder the customer designates; creating files that Traci generates in that folder; reading, moving and renaming files in it; and importing from Drive and Sheets files the customer authorizes. Trac operates the Google OAuth application and handles the file contents in transit.
  • Data categories: Customer uploads and statement files, files Traci generates, and the contents and metadata of the Drive, Docs and Sheets files the customer authorizes.
  • Region(s): To be confirmed.
  • Transfer mechanism: To be confirmed.

Customer-connected destinations (not subprocessors)

Certain features may allow a customer to connect and copy data into external tools that the customer controls (for example, customer-managed Google Drive folders).

  • These destinations are configured and authorized by the customer.
  • The customer-controlled destination itself (for example, the customer's own Google Drive folder and account) is not designated as a Trac subprocessor. Where a Trac integration handles the data in order to move it, as when Google Drive is used to copy uploaded files or to save files Traci creates, the vendor involved is listed above.
  • Customers are responsible for evaluating and managing the privacy and security terms of their connected third-party destinations.

If needed for enterprise diligence, contact legal@trac.bot for clarification on customer-managed integrations.

Subprocessor onboarding standards

Before engaging a subprocessor, Trac performs a risk-based review that may include security, privacy, contractual, and operational due diligence.

Subprocessors are required to implement appropriate technical and organizational safeguards and process data only for authorized purposes.

Updates to this list

We may update this list as vendors and service architecture evolve. Material changes are reflected by updating this page.

Contact

For subprocessor questions or enterprise review requests, contact legal@trac.bot.