Snapshot 202915
Parsed
What we read from this document, as JSON. Each entry names the snapshot it was read from.
{
"entries": [
{
"kind": "subprocessor",
"vendor": "amazon-web-services",
"evidence_id": 44977,
"data": {
"name": "Amazon Web Services Bedrock",
"purposes": [
"Claude and OpenAI model inference for the BEE workspace where the Bedrock route is enabled"
],
"sections": [
"AI and model providers"
],
"locations": [
"EU geo inference profile, starting from Frankfurt"
],
"transfer_mechanisms": [
"EU geo inference route under AWS terms, with no training use of customer data"
]
}
},
{
"kind": "subprocessor",
"vendor": "anthropic",
"evidence_id": 44977,
"data": {
"name": "Anthropic",
"purposes": [
"Claude model provider behind Amazon Bedrock for the BEE EU route, or direct inference where selected"
],
"sections": [
"AI and model providers"
],
"locations": [
"BEE route uses Amazon Bedrock EU geo inference; United States for direct inference unless an approved EU path is selected"
],
"transfer_mechanisms": [
"AWS Bedrock EU route for BEE; SCCs and EU-US Data Privacy Framework where direct"
]
}
},
{
"kind": "subprocessor",
"vendor": "cloudflare",
"evidence_id": 202915,
"data": {
"name": "Cloudflare",
"purposes": [
"Backend application hosting (Containers and Workers) for the Morphed API, worker and MCP services; frontend hosting, static assets, edge delivery and DNS",
"CDN, DDoS protection, DNS, and network security"
],
"sections": [
"Infrastructure"
],
"locations": [
"EU jurisdiction (Western and Eastern Europe) for the application containers; global edge network for the website and static assets",
"Global network with EU controls where available"
],
"transfer_mechanisms": [
"EU jurisdiction for the application containers; SCCs and EU-US Data Privacy Framework where applicable for edge delivery",
"SCCs, EU-US Data Privacy Framework"
]
}
},
{
"kind": "subprocessor",
"vendor": "hubspot",
"evidence_id": 44977,
"data": {
"name": "HubSpot",
"purposes": [
"Customer-facing CRM integration, UI extension surface, and customer authorised CRM operations"
],
"sections": [
"Supporting services"
],
"locations": [
"United States or EU depending on the customer portal"
],
"transfer_mechanisms": [
"SCCs, EU-US Data Privacy Framework"
]
}
},
{
"kind": "subprocessor",
"vendor": "openai",
"evidence_id": 44977,
"data": {
"name": "OpenAI",
"purposes": [
"LLM inference for governed agent reasoning and document generation where selected"
],
"sections": [
"AI and model providers"
],
"locations": [
"EU routing where enabled, including Amazon Bedrock EU geo inference for the BEE workspace; otherwise United States with minimised payloads"
],
"transfer_mechanisms": [
"SCCs, EU-US Data Privacy Framework, no training use for API data"
]
}
},
{
"kind": "subprocessor",
"vendor": "pinecone",
"evidence_id": 44977,
"data": {
"name": "Pinecone",
"purposes": [
"Vector database for embeddings and retrieval where selected instead of Supabase pgvector"
],
"sections": [
"AI and model providers"
],
"locations": [
"EU region where selected"
],
"transfer_mechanisms": [
"EU hosted where selected, SCCs where applicable"
]
}
},
{
"kind": "subprocessor",
"vendor": "resend",
"evidence_id": 44977,
"data": {
"name": "Resend",
"purposes": [
"Transactional email for approvals, alerts, sign-in, and service notifications"
],
"sections": [
"Supporting services"
],
"locations": [
"European Union"
],
"transfer_mechanisms": [
"EU hosted, no transfer required for primary email processing"
]
}
},
{
"kind": "subprocessor",
"vendor": "supabase",
"evidence_id": 44977,
"data": {
"name": "Supabase",
"purposes": [
"Postgres database, authentication, file storage, and pgvector retrieval where enabled"
],
"sections": [
"Infrastructure"
],
"locations": [
"Frankfurt, Germany or selected EU region"
],
"transfer_mechanisms": [
"EU hosted, no transfer required for primary storage"
]
}
}
]
}