Every third party that processes client data.
The full list of sub-processors BuiltAI uses to deliver the platform. Updated when the list changes; the canonical changelog entry tags any change.
| Provider | Purpose | Region | DPA |
|---|---|---|---|
| Vercel Inc. | Hosting and edge delivery of the marketing site, app and portal. Stores no client content beyond ephemeral request/response logs. | EU (Frankfurt) for compute · global edge for static assets | DPA in place · EU-US DPF |
| Supabase Inc. | Primary database (Postgres), authentication, and object storage. Holds client account data, engagement data and uploaded artefacts. | EU (eu-west-1, Ireland) | DPA in place · SCCs |
| Anthropic PBC | AI inference (Claude family models) for governed AI features. Inputs are R/A/G classified at upload; Red is hard-blocked from leaving BuiltAI. | Anthropic-managed (US) · zero data retention enabled | DPA in place · zero-retention API tier |
| Resend, Inc. | Transactional email delivery (acknowledgements, board-report links, internal notifications). Email content + recipient address. For the discovery questionnaire the internal notification body carries the respondent's full set of answers; any documents they attach are delivered as signed, expiring links to our private EU storage, not as email attachments. | US company · messages sent from the eu-west-1 region | DPA in place · SCCs |
| Plausible Insights OÜ (Plausible Analytics) | Website analytics. Cookieless and aggregate: no cross-site tracking and no advertising profiles. Records page views and named product events (for the discovery questionnaire: started, draft restored, documents attached as a count, saved as PDF, submitted, rejected by validation, abandoned - carrying the readiness band and score, a completion bucket, the last section viewed and, on a rejection, the names of the fields that failed). No answer values, no field contents and no filenames are ever sent. | EU — company registered in Estonia; EU-hosted on European-owned infrastructure | DPA in place · incorporated into the provider's terms (accepted by use; no separate signature) |
| Functional Software, Inc. d/b/a Sentry | Error and performance monitoring. Receives stack traces, browser metadata and user IDs scrubbed of personal data via Sentry's PII filter. | US (Sentry default) | DPA in place · SCCs |
Data classification at the door
R/A/G classification runs at every upload boundary. Red data (personal data, security-sensitive, regulated) is hard-blocked from AI calls regardless of which sub-processor is involved.
Notice before changes
If we add a new sub-processor or change region, we publish to /changelog with a 'Sub-processor change' tag and notify the named procurement contact for any active engagement.
DPAs and SCCs in place
Every sub-processor on this list has a Data Processing Addendum in place - signed, or incorporated into the provider's standard terms where that is how the provider contracts (each row says which) - plus standard contractual clauses where required for international transfer.
Procurement reviewing? Request the signed summary that lists this page plus our standard SOW clauses, AI Schedule and liability cap.
Procurement reviewing?
Request the signed summary