Version 1.0 · Effective 2026-07-11
Subprocessors
A subprocessor is a company we use that may touch your data in the course of running BloomOS. This is the complete list. It's referenced by our data processing addendum, and it's the page you should bookmark rather than a PDF, because we update it here.
Current subprocessors
| Company | What it does for BloomOS | Data it may process | Where |
|---|---|---|---|
| Supabase | The production database and authentication. This is where your data lives. | All customer data in BloomOS. | United States (on AWS) |
| Vercel | Hosts and serves the application. | Data in transit while pages render. Request logs. | United States |
| Anthropic | The Claude API, which powers Reed and every AI feature. | Only the data sent by an AI feature you invoke. See how BloomOS uses AI. | United States |
| Resend | Sends transactional email (notifications, digests, invitations, acknowledgments). | Recipient names and email addresses, and the content of the message being sent. | United States |
| Amazon Web Services | The underlying infrastructure beneath Supabase. We don't hold a direct AWS relationship. | All customer data, at rest. | United States |
Optional integrations you turn on
These only process your data if you connect them. If you never connect them, they never see anything.
| Company | What it does | Data it may process |
|---|---|---|
| Google (Workspace, Calendar, Gmail) | Calendar sync and email logging, if you connect your Google account. | Calendar events and email metadata from the account you connect. |
| HubSpot | A migration path for organizations moving off HubSpot. Read-only. | The contacts, companies, and deals in the HubSpot portal you connect. |
Not yet active
| Company | What it will do | Status |
|---|---|---|
| Stripe | Subscription billing for BloomOS itself. | Not live. When it goes live, Stripe will process your billing contact and payment method. It will never process the data inside your BloomOS account. BloomOS does not store payment card numbers, then or now. |
Certifications these companies hold
We don't have SOC 2. Several of the companies we build on do, and we'd rather tell you which ones than let the distinction blur.
- Anthropic: SOC 2 Type I and Type II, ISO 27001:2022, ISO 42001
- Supabase, Vercel, AWS, Stripe, Google: each publishes its own compliance posture, which you can verify directly rather than take our word for.
How we tell you when this changes
If we add a subprocessor that will process customer data, we'll update this page and email the primary contact at every customer organization at least 30 days before the new subprocessor starts processing anything.
If you have a reasonable objection on data protection grounds, tell us within those 30 days and we'll work it out with you. If we can't, you can terminate for that reason without penalty and get a prorated refund.
What we don't use
No advertising networks. No analytics that follow you across the web. No data brokers. No third-party session recording. The marketing site you're reading uses Vercel Analytics, which is cookieless and doesn't identify you, which is why this site has never shown you a cookie banner.
Questions: privacy@bloomos.org.