1. How this register works
Custody and trust administration engage different third parties depending on the account types held, the assets custodied and the reporting produced. A single fixed list published for everyone would be wrong for almost everyone — either overstating who touches your data or omitting a party a specific integration introduces.
So the register is two-tier. Constants apply to every engagement. Engagement-specific entries are issued as a completed exhibit and are the authoritative list for you.
What this page is not
- It is a register, not a claim of completeness for your engagement. For a definitive list to put in front of your own vendor-risk committee, request the completed exhibit — clause 5.
2. Constants — every engagement
| Subprocessor | Purpose | Applies to |
|---|---|---|
| Microsoft Azure | Hosting, compute, storage and networking for all environments | All engagements |
| Twilio | SMS and telephony, including operational and security notifications | All engagements |
3. Engagement-specific
Engaged only where the engagement uses them. The named party, its role and its region are recorded in your completed exhibit.
| Category | Engaged when |
|---|---|
| Document execution and electronic signature — for example DocuSign | Account documents or agreements are executed electronically |
| Identity and entity verification, sanctions and watchlist screening | The engagement performs KYC, KYB or ongoing screening |
| Payment, transfer and settlement rails | The engagement moves funds — contributions, distributions, transfers or subscriptions |
| Alternative-asset valuation and pricing sources | Positions are valued or priced for statements |
| Tax reporting and information return production | The engagement produces information returns such as 1099 or 5498 series forms |
| Statement and notice production, print and mail | Statements or notices are delivered outside the portal |
| Customer support, ticketing and communication tooling | Our supported support channels are used |
| Observability, logging and error reporting | Standard for production environments; region-configurable |
4. Region
Each entry in your completed exhibit records the subprocessor, its role and its region, so residency can be assessed across the whole chain rather than only at the hosting layer. Hosting region is set at provisioning — changing it after data exists is a migration, and for a regulated institution it involves telling your regulator.
5. Requesting your engagement register
Email legal@investorservices.com with your institution and engagement. Exhibit C is issued alongside Exhibit A (nature of processing) and Exhibit B (technical and organisational measures). Those three together are what a vendor-risk file normally needs; requesting them separately is how a review takes three weeks instead of three days.
6. Notice and objection
Under clause 5 of the DPA we give notice of an intended new or replacement subprocessor, with a reasonable period to object on reasonable data-protection grounds. Send the address that should receive those notices, so a change reaches your vendor-risk owner rather than waiting to be noticed on a web page.
Institutional Trust Company is a proposed trust entity seeking a South Dakota non-depository trust charter. It is not yet chartered, is not accepting accounts, and no regulator has approved any application. Investor Services is a pre-charter demonstration and reference experience operated by Financial Infrastructure, Inc.. Nothing on this site is an offer or solicitation of any security. For self-directed accounts the custodian is a directed, non-discretionary, independent custodian — not a fiduciary, adviser or broker-dealer; the account holder directs, and the custodian does not evaluate, recommend or approve any investment. Trust services are different: a trustee is a fiduciary, and trust-administration duties are described in the applicable trust documents.