Current Sub-processors
New sub-processors are notified at least 30 days in advance via email and updates to this page (see DPA §5). Customers may object to new sub-processors per the DPA's procedure.
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — compute, database, storage, networking | UAE / Bahrain (me-central-1) for GCC; Mumbai (ap-south-1) for Pakistan | View → |
| Polar Software Inc. | Merchant of Record — payment processing, invoicing, global sales tax / VAT compliance | USA / EU | View → |
| Stripe, Inc. | Backup payment processor (self-hosted deployments + edge cases) | USA / EU | View → |
| Cloudflare | CDN, DNS, DDoS protection (planned) | Global edge network | View → |
| Anthropic (Claude AI) | AI assistant + insight generation (only when customer enables AI features) | USA | View → |
| SendGrid / Postmark / SES | Transactional email delivery (one provider chosen at deploy time) | USA / EU | — |
| Sentry, Inc. | Error tracking + performance monitoring (planned) | USA (EU residency option for Enterprise) | View → |
| GitHub, Inc. | Source code hosting + CI/CD (no Customer Data passes through) | USA | View → |
A note on AI providers
Customer Data is sent to Anthropic only when the customer enables AI features and only the minimum data needed to answer the specific question or generate the requested insight. Anthropic does not use customer data to train models. Customers can disable AI features entirely from workspace settings.
Changes
We update this page within 30 days of any sub-processor addition or removal. Subscribe to changes by emailing security@byro.io with subject “Sub-processor change notifications”.