Every third party that processes client data.
The full list of sub-processors BuiltAI uses to deliver the platform. Updated when the list changes; dated change records are retained in this register.
Scroll horizontally to read all four columns. With a keyboard, focus the register below and use the Left and Right arrow keys.
| Provider | Purpose | Region | DPA |
|---|---|---|---|
| Vercel Inc. | Hosting and edge delivery of the marketing site, app and portal. Stores no client content beyond ephemeral request/response logs. | EU (Dublin, Ireland) for compute · global edge for static assets | DPA in place · EU-US DPF |
| Supabase Inc. | Primary database (Postgres), authentication, and object storage. Holds client account data, engagement data and uploaded artefacts. | EU (eu-west-1, Ireland) | DPA in place · SCCs |
| Anthropic Ireland, Limited | AI inference (Claude family models) for governed AI features. Inputs are R/A/G classified at upload; Red is hard-blocked from leaving BuiltAI. Anthropic retains the content we send and the outputs derived from it on a 30-day default and deletes them on our instruction once the deliverable is sealed and validated; we are not currently on a zero-retention arrangement. Anthropic does not train its models on your content (contractual commitment). If the optional Explore adviser is made available, it sends visitor message text to Anthropic, where a model generates responses based on approved BuiltAI service guidance; it does not send visitor-uploaded files. The general retention and sealed-deliverable terms in this entry are not an adviser-specific retention or classification promise, and this page does not state whether they apply to adviser messages. No separate adviser-message retention period or zero-retention status is stated here. | Contracting entity in Ireland (EEA) · processing on Anthropic infrastructure in the United States | DPA in place · EU SCCs (Module 3) + UK Addendum |
| Resend, Inc. | Transactional email delivery (acknowledgements, board-report links, internal notifications). Email content + recipient address. For the discovery questionnaire the internal notification body carries the respondent's full set of answers; any documents they attach are delivered as signed, expiring links to our private EU storage, not as email attachments. | US company · messages sent from the eu-west-1 region | DPA in place · SCCs |
| Cal.com, Inc. | Online booking calendar for calls, embedded on our site. Receives what you enter when you book, such as your name, email address and chosen time. Sends us booking, reschedule and cancellation notifications - name, email address, booking time, event type and any cancellation or rejection reason - which we record against your enquiry. | US company · processing in the United States | DPA in place · SCCs or EU-US DPF |
| Plausible Insights OÜ (Plausible Analytics) | Website analytics. Cookieless and aggregate: no cross-site tracking and no advertising profiles. Records page views and named product events (for the discovery questionnaire: started, draft restored, documents attached as a count, saved as PDF, submitted, rejected by validation, abandoned - carrying the readiness band and score, a completion bucket, the last section viewed and, on a rejection, the names of the fields that failed). No answer values, no field contents and no filenames are ever sent. | EU - company registered in Estonia; EU-hosted on European-owned infrastructure | DPA in place · incorporated into the provider's terms (accepted by use; no separate signature) |
| Functional Software, Inc. d/b/a Sentry | Error and performance monitoring. Receives stack traces, browser metadata and user IDs scrubbed of personal data via Sentry's PII filter. | US (Sentry default) | DPA in place · SCCs |
Data classification at the door
R/A/G classification runs at every upload boundary. Red data (personal data, security-sensitive, regulated) is hard-blocked from AI calls regardless of which sub-processor is involved.
Notice before changes
If we add a new sub-processor or change region, we update this register and notify the named procurement contact for any active engagement.
DPAs and SCCs in place
Every sub-processor on this list has a Data Processing Addendum in place - signed, or incorporated into the provider's standard terms where that is how the provider contracts (each row says which) - plus standard contractual clauses where required for international transfer.
Sub-processor change history
Sub-processors: Cal.com added and Vercel compute region corrected
Cal.com (online booking calendar) is now listed. Vercel compute runs in the EU (Dublin, Ireland); the register previously said Frankfurt.
Procurement review
Procurement reviewing? Request the signed summary that lists this page plus our standard SOW clauses, AI Schedule and liability cap.