Subprocessors
Last updated: September 26, 2026
A subprocessor is a third party we engage to process personal data on our behalf when we act as a processor for our customers (see the DPA) or to run our own website and communications (see the Privacy Policy). We have a data processing agreement with each of them, and where personal data leaves the EEA/UK the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Current subprocessors
| Subprocessor | Purpose | Data categories | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. (USA) | Application & website hosting, CDN, edge delivery | Connection and usage data, server logs | USA | SCCs / EU-US DPF |
| Supabase Inc. (USA) | Database, authentication, file storage | All account and application data | EU (eu-central-1) | SCCs |
| Cloudflare, Inc. (USA) | Bot / spam protection on forms (Turnstile) | IP address, browser and device signals | USA / global edge | SCCs / EU-US DPF |
| Plus Five Five, Inc. - Resend (USA) | Transactional email (contact and feedback notifications) | Sender / recipient email address, message content | USA | SCCs |
| Apple Inc. (USA) | Outbound SMTP for transactional email (sign-up confirmation, invitations, password reset, waitlist confirmation) | Recipient email address | USA | SCCs / EU-US DPF |
| Google LLC / Google Ireland Ltd. | Website analytics (Google Analytics 4), consent-gated | Pseudonymous usage data, _ga identifier | USA / EU | EU-US DPF |
| Anthropic, PBC (USA) | AI extraction of line items from uploaded delivery notes, invoices and sales reports (AI scan) | Uploaded document and the data it contains | USA | SCCs |
| ActiveCampaign, LLC / Postmark (USA) | Receiving supplier mails at the optional company inbox address (mail inbox) | Incoming mail incl. sender, subject and attachments | USA | SCCs |
| GitHub, Inc. (USA) | Storage of encrypted daily database backups | All account and application data, encrypted before upload | USA | SCCs / EU-US DPF |
| Functional Software, Inc. - Sentry (USA) | Application error monitoring (crash reporting) | Error messages and stack traces, the route requested, browser/device type, navigation steps leading up to the error; no IP address, no cookies, no form or request bodies | EU (Germany) | SCCs |
| Paddle.com Market Limited (United Kingdom) | Billing and payment processing as merchant of record (from paid plans / after the beta) | Billing and payment data, transaction history | UK / EU / USA | UK adequacy decision / SCCs |
Changes
We will update this page before adding or replacing a subprocessor. Customers who have signed the DPA and wish to be notified of changes can email privacy@bevorax.im; reasonable objections to a new subprocessor can be raised within 30 days of the change.