Sub-processors

These providers process personal data for us. Those marked "customer data" are sub-processors under the Data Processing Agreement; we announce any addition or replacement to your administrators at least 30 days in advance. A copy of each transfer safeguard is available from privacy@bluri.ai.

Vercel Inc.

• Purpose: Application hosting, file storage (Vercel Blob), cookieless web analytics, bot protection
• Location: United States (region iad1, Washington, D.C.)
• Transfer safeguard: EU–US Data Privacy Framework (certified, HR and non-HR data); standard contractual clauses in its DPA
• Data: customer data (sub-processor)

Databricks, Inc. (Neon, LLC)

• Purpose: Managed PostgreSQL database and its backups
• Location: United States (AWS us-east-1)
• Transfer safeguard: EU–US Data Privacy Framework (certified for non-HR data); standard contractual clauses in its DPA, which cover payroll data
• Data: customer data (sub-processor)

Anthropic, PBC

• Purpose: AI extraction and classification of uploaded documents (commercial API; no training on customer content)
• Location: United States
• Transfer safeguard: Standard contractual clauses (Modules 2 and 3) in its Data Processing Addendum; not certified under the Data Privacy Framework
• Data: customer data (sub-processor)

Upstash, Inc.

• Purpose: Rate limiting (request counters keyed by IP address or user id)
• Location: United States
• Transfer safeguard: EU–US Data Privacy Framework as its DPA states, with standard contractual clauses incorporated where the Framework does not cover the transfer
• Data: customer data (sub-processor)

Functional Software, Inc. (Sentry)

• Purpose: Error monitoring (stack traces; passwords, tokens, tax ids, emails and IBANs removed before sending)
• Location: European Union (Frankfurt, Germany)
• Transfer safeguard: Stored in the EU; Data Privacy Framework (certified, non-HR) for any access from the United States
• Data: customer data (sub-processor)

Microsoft (Microsoft 365, Exchange Online)

• Purpose: Sending transactional email (invitations, notices, documents you send)
• Location: European Union and United States
• Transfer safeguard: Standard contractual clauses (Microsoft Products and Services DPA, Attachment 2); Microsoft states it is certified under the Data Privacy Framework
• Data: customer data (sub-processor)

Stripe

• Purpose: Card payments for bluri subscriptions (card data never reaches bluri)
• Location: European Union and United States
• Transfer safeguard: EU–US Data Privacy Framework (Stripe, LLC, certified); standard contractual clauses
• Data: bluri account and billing data