Driftwise LLC ("Driftwise") engages a limited set of third-party service providers ("sub-processors") to help operate the Services. This page lists those sub-processors, what they do, and the categories of data that flow to them. It is maintained as a current snapshot; we will update it before adding or replacing a sub-processor that processes customer personal data, consistent with our agreements with our customers.

1. Core Infrastructure

The Driftwise Portal, Driftwise Mobile application, and Driftwise backend services are hosted on Amazon Web Services. The following AWS services process customer or end-user data within Driftwise-controlled AWS accounts. All AWS services listed below run in us-west-2 (production) andus-east-1 (staging/QA) unless otherwise noted.

Amazon Web Services — Compute and edge (ECS Fargate, EC2, ALB, API Gateway, Lambda, AWS WAF): application runtime, load balancing, API edge, and request filtering. Data: all in-flight request and response payloads, including authentication tokens, account data, and submitted content.
Amazon Web Services — RDS (Amazon Aurora / RDS for MySQL and PostgreSQL with PostGIS): primary databases for accounts, organizations, fisheries records, and geospatial data. Data: account profile information, organization metadata, asset and corridor records, status records, geospatial data.
Amazon Web Services — Cognito: identity provider for portal users and public mobile users. Data: email address, password (hashed by Cognito), MFA secrets, JWT claims (tenant and organization identifiers).
Amazon Web Services — Simple Email Service (SES): transactional email delivery (account verification, password reset, demo-request notifications). Data: recipient email addresses, message contents.
Amazon Web Services — S3: object storage for user-uploaded photos, file imports, and public assets. Data: photos (with embedded EXIF metadata, where present), CSV/file imports, generated derivatives.
Amazon Web Services — SQS: message queues for upload processing and import pipelines. Data: object keys and metadata referencing uploaded files; no message body contains user content directly.
Amazon Web Services — CloudFront: content delivery network for public assets and signed-URL delivery of photo derivatives. Data: image and asset requests with associated viewer IP addresses; signed URLs/cookies.
Amazon Web Services — CloudWatch: application and infrastructure logs, metrics, and alarms. Data: structured request and error logs, which may include user identifiers in error contexts.
Amazon Web Services — Route 53 and ACM: DNS resolution and TLS certificate management for Driftwise-owned domains. Data: DNS query metadata.

2. Maps and Geospatial

Mapbox, Inc. (United States): vector and raster map tiles, geocoding, and map style rendering across the Portal, Mobile application, and embedded widgets. Data: viewer IP address, viewport coordinates, and tile or style requests; for embed deployments, the customer's domain name (used to scope public access tokens).
OpenStreetMap Foundation (United Kingdom): alternate base map tiles available in the Driftwise Mobile application. Data: viewer IP address, viewport tile coordinates.
Esri (Environmental Systems Research Institute, Inc.) (United States): satellite imagery base layer (ArcGIS Online World Imagery) available in the Driftwise Mobile application. Data: viewer IP address, viewport tile coordinates.
CARTO (United States and Spain): light raster basemap tiles used in selected Portal map components (HUC drill-down map, region selector). Data: viewer IP address, viewport tile coordinates.

3. Reference Data Sources

The Driftwise Portal queries the following external sources to enrich operational data with environmental and hydrologic context. Requests are issued from the user's browser; the services receive the user's IP address and the lat/long or site identifier included in the request.

Open-Meteo (Germany): historical and current weather data (temperature, barometric pressure) used to auto-fill conditions on entity creation and photo review. Data: latitude, longitude, date range, viewer IP address.
U.S. Geological Survey — National Water Information System (United States): stream gauge and flow data for waterways. Data: USGS site numbers, latitude, longitude, date range, viewer IP address.

4. Embedded Widget Resources

When a customer organization embeds a Driftwise map or status widget on its own website, the widget loads the following third-party resources directly in the visitor's browser. The customer organization is responsible for disclosing and, where required, obtaining consent for these resources under Section 6 of the Terms of Use.

Mapbox, Inc. (United States): map rendering library and tiles loaded inside the embedded widget. See Section 2 above for data categories.
Google LLC — Google Fonts (United States): the Manrope font stylesheet served from fonts.googleapis.com and fonts.gstatic.com. Data: visitor IP address and referring URL.
goqr.me / api.qrserver.com (Andreas Haerter) (Germany): server-side QR-code image generation for the widget's "Powered by Driftwise" share dialog. Data: visitor IP address and the encoded URL passed in the request.

5. Website Analytics

The following providers run on the public driftwise.co marketing site only. They are not loaded in the Driftwise Portal, the Driftwise Mobile application, or embedded customer widgets, and they never receive customer records or field data.

Plausible Analytics (Plausible Insights OÜ) (Estonia, hosted in the European Union): aggregate website traffic measurement. Cookieless — it sets no persistent identifier and no cross-site profile. Data: page URL, referring URL, browser and operating system family, device type, and a country derived from the visitor's IP address, which is discarded after processing and never stored.
Microsoft Corporation — Microsoft Clarity (United States): heatmaps and session replay used to diagnose usability problems on the marketing site. Loaded only for visitors who accept analytics cookies in our consent banner. Data: cookie-based session identifier, page URL, viewport size, click and scroll coordinates, and a replay of page interactions with text and form input masked by default.

6. Mobile Application Distribution

The Driftwise Mobile application is distributed through Apple and Google application marketplaces. These platforms process device and account information directly with the user under their own terms and privacy policies; they are listed here for transparency but are not sub-processors of Driftwise in the conventional sense.

Apple Inc. — App Store and TestFlight (United States): iOS distribution and beta testing. Data: device identifiers, install and crash telemetry handled by Apple under its terms.
Google LLC — Google Play (United States): Android distribution. Data: device identifiers, install and crash telemetry handled by Google under its terms.

7. Changes to This List

We will update this page when we add, remove, or replace a sub-processor. For changes that affect customer personal data, we will provide at least thirty (30) days' advance notice before the new sub-processor begins processing, by:

updating this page; and
sending notice to the primary administrative contact on file for the customer organization, or to the email address designated in any signed data processing agreement.

A customer organization that objects to a new sub-processor on reasonable data-protection grounds may notify us at within thirty (30) days of our notice. We will work in good faith to address the objection; if we cannot, the customer may terminate the affected portion of the Services without further charge for the unused, prepaid period.

These default notice and objection terms apply to every customer organization that processes personal data through the Services. If a customer organization has signed a data processing agreement with Driftwise that establishes different terms, that agreement controls.

8. Contact

Driftwise LLC
Attn: Legal