Subprocessors
This page lists the Subprocessors that Bratrax engages to Process Customer Personal Data under the Data Processing Agreement. It forms Annex III of that DPA and of the Standard Contractual Clauses incorporated into it. Changes are notified in accordance with Section 5.3 of the DPA, and Customer may object on reasonable data protection grounds under Section 5.4.
Subprocessors of Customer Personal Data
| Subprocessor | Location | Purpose | Data processed |
|---|---|---|---|
| Hetzner Online GmbH | Finland (EU) | Primary cloud hosting infrastructure for Customer Data | All categories of Customer Personal Data described in Annex I of the DPA |
| Anthropic PBC | United States | Powers AI features Bratrax operates, including the Bratrax assistant for Slack and the in-product AI sidebar (Section 11.1) | The user's question, recent conversation context, and the Customer Personal Data needed to answer it. Transmitted to generate a response only, and not used to train models (Section 11.4). |
| Slack Technologies (Salesforce, Inc.) | United States | Hosts the Bratrax community Slack workspace, which Bratrax operates under its own agreement with Slack. Listed on that basis only — where Customer installs the assistant into Customer's own workspace, Slack Processes under Customer's agreement and is not a Bratrax Subprocessor (Section 11.3). | Assistant replies delivered in a linked channel of the community workspace, including any figures, tables, or charts drawn from Customer Data |
| Google Cloud | United States | Storage of encrypted backups of Customer Personal Data | Backups of all categories of Customer Personal Data described in Annex I of the DPA |
| Software development and support contractors | Outside the EEA. The countries concerned, and the name of each entity, are available on request to legal@bratrax.com | Development, maintenance, and support of the Service | Access to Customer Personal Data held in Bratrax's systems, to the extent required to perform those services. Each entity is engaged under written data protection terms no less protective than the DPA and, where established outside the EEA, under the Standard Contractual Clauses |
| Twilio SendGrid (Twilio Inc.) | United States | Delivery of transactional email arising from user administration — account and team invitations, password resets, connector alerts, and service notices | Name and email address of Customer's authorized users, and the content of the notices sent to them |
On the contractor entry. Bratrax's development and support work is performed by contractors engaged through their own legal entities, listed as a category. The current list of entities and countries is provided on request to legal@bratrax.com, and any addition to this group is notified under Section 5.3 of the DPA, carrying the same right to object under Section 5.4.
Transfers to Subprocessors located outside the EEA are made under the transfer mechanisms described in Section 10 of the DPA, and each such Subprocessor is bound by data protection terms no less protective, in substance, than those in the DPA.