# Sub-processors

> **Draft: needs the owner's lawyer review.** Not legal advice.

Bill & Ben acts as a **processor** of customer content and a **controller** of account and billing data.
Where a vendor's processing location is not yet confirmed, this list says "Not stated"; the owner confirms it with the vendor before publication.
Customers get 30 days notice of a change.

## Sub-processors that can receive customer personal data

| Sub-processor | Purpose | Location | Customer data |
|---|---|---|---|
| Hetzner Online (cloud servers and backup storage) | Hosts every service, the databases, tenant agent environments and backups | Not stated (the hosting region is chosen at purchase) | All content, encrypted at rest only as configured by the owner |
| Anthropic | Language models | Not stated; optional EU residency through AWS Bedrock `eu-west-2` | Prompts and answers |
| OpenAI | Language models, speech-to-text, embeddings | Not stated; optional Azure OpenAI UK South | Prompts, audio snippets, text to embed |
| Google (language-model API) | Meeting model and fallbacks | Not stated; optional Vertex `europe-west2` | Meeting transcript text |
| Deepgram | Meeting speech-to-text | Not stated | Meeting audio |
| ElevenLabs | Spoken answers (text-to-speech) | Not stated | Answer text |
| Microsoft (Teams, Azure Bot Service, Microsoft Graph, Entra sign-in) | Teams chat and meeting channel, identity link, sign-in | Customer's own Microsoft 365 tenant region; bot registration region not stated | Chat text, meeting join, identity claims |
| E2B (FoundryLabs, Inc.: entity unverified) | Sandboxed task execution | EU cluster requested (Pro), not confirmed in writing | Task inputs and files given to the sandbox |
| Exa | Web search queries issued by agents | Not stated | Search query text |
| Firecrawl | Page extraction for agents | Not stated | URLs and page content fetched |
| Stripe (Billing, Tax) | Subscriptions, invoices, VAT; controller of its own payment data | Not stated | Billing contact and company data only |
| Better Stack | Uptime monitoring, log source, status page | Not stated | Service logs (must not carry content: the owner checks the log scrubbing before launch) |
| Email sender (provider chosen by the owner) | Invitation and login-code email | Not stated; the provider is not yet chosen | Recipient email address |

## Optional sub-processors (only when the tenant or the owner enables them)

| Sub-processor | Purpose |
|---|---|
| Mistral, xAI, DeepSeek | Extra model upstreams |
| Brave Search | Second search backend |
| Figma | Read-only design reviews with a company token |
| Langfuse Cloud | Model traces (prompts leave our servers; leave it off for customers that exclude it) |
| Google (OAuth sign-in) | Customer login with Google |
| Knowledge-base licence vendor | Licence only; the knowledge base itself is run by us |

A customer can exclude a model vendor with its per-tenant model allow-list.

## Run by us, not sub-processors (they never leave our servers)

No third party sees customer data through these: the sign-in and permission systems, our databases, the meeting bot service, the Hermes agents,
and the Bill & Ben services themselves (console, access, billing, compliance).

## Infrastructure vendors with no customer content

Azure Container Registry holds images only; GoDaddy holds DNS records only.

## Change process

1. The owner updates this list and tells every customer 30 days before a new sub-processor receives customer data.
2. A customer may object in writing; the [DPA template](dpa-template.md) sets what follows.