Sub-processors¶
Draft: needs the owner's lawyer review. Not legal advice.
Bill & Ben acts as a processor of customer content and a controller of account and billing data. Where a vendor's processing location is not yet confirmed, this list says "Not stated"; the owner confirms it with the vendor before publication. Customers get 30 days notice of a change.
Sub-processors that can receive customer personal data¶
| Sub-processor | Purpose | Location | Customer data |
|---|---|---|---|
| Hetzner Online (cloud servers and backup storage) | Hosts every service, the databases, tenant agent environments and backups | Not stated (the hosting region is chosen at purchase) | All content, encrypted at rest only as configured by the owner |
| Anthropic | Language models | Not stated; optional EU residency through AWS Bedrock eu-west-2 |
Prompts and answers |
| OpenAI | Language models, speech-to-text, embeddings | Not stated; optional Azure OpenAI UK South | Prompts, audio snippets, text to embed |
| Google (language-model API) | Meeting model and fallbacks | Not stated; optional Vertex europe-west2 |
Meeting transcript text |
| Deepgram | Meeting speech-to-text | Not stated | Meeting audio |
| ElevenLabs | Spoken answers (text-to-speech) | Not stated | Answer text |
| Microsoft (Teams, Azure Bot Service, Microsoft Graph, Entra sign-in) | Teams chat and meeting channel, identity link, sign-in | Customer's own Microsoft 365 tenant region; bot registration region not stated | Chat text, meeting join, identity claims |
| E2B (FoundryLabs, Inc.: entity unverified) | Sandboxed task execution | EU cluster requested (Pro), not confirmed in writing | Task inputs and files given to the sandbox |
| Exa | Web search queries issued by agents | Not stated | Search query text |
| Firecrawl | Page extraction for agents | Not stated | URLs and page content fetched |
| Stripe (Billing, Tax) | Subscriptions, invoices, VAT; controller of its own payment data | Not stated | Billing contact and company data only |
| Better Stack | Uptime monitoring, log source, status page | Not stated | Service logs (must not carry content: the owner checks the log scrubbing before launch) |
| Email sender (provider chosen by the owner) | Invitation and login-code email | Not stated; the provider is not yet chosen | Recipient email address |
Optional sub-processors (only when the tenant or the owner enables them)¶
| Sub-processor | Purpose |
|---|---|
| Mistral, xAI, DeepSeek | Extra model upstreams |
| Brave Search | Second search backend |
| Figma | Read-only design reviews with a company token |
| Langfuse Cloud | Model traces (prompts leave our servers; leave it off for customers that exclude it) |
| Google (OAuth sign-in) | Customer login with Google |
| Knowledge-base licence vendor | Licence only; the knowledge base itself is run by us |
A customer can exclude a model vendor with its per-tenant model allow-list.
Run by us, not sub-processors (they never leave our servers)¶
No third party sees customer data through these: the sign-in and permission systems, our databases, the meeting bot service, the Hermes agents, and the Bill & Ben services themselves (console, access, billing, compliance).
Infrastructure vendors with no customer content¶
Azure Container Registry holds images only; GoDaddy holds DNS records only.
Change process¶
- The owner updates this list and tells every customer 30 days before a new sub-processor receives customer data.
- A customer may object in writing; the DPA template sets what follows.