Subprocessors
A subprocessor is a third party that processes customer data on our behalf. The list below covers every party that touches customer-tenant data or operational telemetry for DPP Agent. We post material additions or removals here before they take effect and notify customers per contract.
Last updated: 2026-10-04
| Provider | Purpose | Region | DPA |
|---|---|---|---|
| Vercel Inc. Infrastructure | Application hosting, edge network, serverless functions, cron scheduling | Server functions: Frankfurt (fra1). Public pages: edge location nearest the reader | View DPA |
| Supabase Inc. Data | Managed Postgres database, authentication, storage. Hosts tenants, dpp_runtime, audit tables. | eu-central-1 (Frankfurt, AWS) | View DPA |
| Google LLC (Gemini API) AI | Default AI provider (Gemini API) for AI Suggest, brand discovery and source extraction. Receives the text an AI feature works on. | US | View DPA |
| Anthropic PBC AI | Alternative AI provider, used only when a tenant selects it with its own API key (BYOK). | US | View DPA |
| OpenAI, L.L.C. AI | Alternative LLM provider (used only when explicitly selected per tenant via BYOK). | US (no data retention on API) | View DPA |
| Stripe Payments Europe, Ltd. Payments | Card payments and subscriptions. Receives billing details only. | EU (Stripe Payments Europe, Ireland) | View DPA |
| Resend, Inc. Communication | Invoice and payment reminder emails. | US | View DPA |
| Amazon Web Services EMEA SARL (AWS SES) Communication | Transactional email (magic-link sign-in, invitations, status alerts). | EU (Stockholm / Frankfurt) | View DPA |
| GitHub, Inc. Infrastructure | Source control. No production customer data is committed to source. | US | View DPA |
Customer notification
Material changes — adding a subprocessor that processes content of customer records, or relocating data outside the EEA — are announced here and to tenant owners by email before the change goes into effect. Customers with an active contract may object to a new subprocessor within the notice period; objection paths are described in the Data Processing Agreement.
Customer-controlled providers (BYOK)
Tenants who configure their own integration credentials (Akeneo, Centra, Shopify, inriver, Delogue, TrusTrace, custom REST endpoints) are authorising those providers directly — not via DPP Agent. We do not list customer-controlled providers as our subprocessors. The same applies to tenant-supplied LLM API keys (BYOK).
Contact
Questions about a subprocessor, the DPA, or transfer mechanisms: sales@blippa.com.