Subprocessors

Last updated: 2026-04-28 · Review cadence: quarterly

The following companies process limited categories of personal data on behalf of BestCoder, strictly to operate the Service. We notify customers at least 30 days before adding or removing a subprocessor; subscribe to changes by emailing dpo@bestcoder.app.

Active subprocessors

| Vendor | Role | Region | Transfer mechanism | Reviewed | |---|---|---|---|---| | Vercel Inc. | Hosting (control plane), Image Optimization, Analytics | US (eu-west-3 deployments) | SCC Module 3 + TIA + EU-resident edge | 2026-04 | | Neon, Inc. | PostgreSQL database (managed) | EU (eu-central-1, Frankfurt) | None — EU-only | 2026-04 | | Anthropic PBC | AI inference (Claude), customer BYOK only | US | SCC + customer's own API key (we never see the key) | 2026-04 | | OpenAI OpCo, LLC | AI inference (Codex / GPT), BYOK only | US | SCC + customer's own API key | 2026-04 | | Google LLC | AI inference (Gemini), BYOK only | EU/US | SCC + customer's own API key | 2026-04 | | Stripe Payments Europe Ltd | Payment processing | Ireland | None — EU-only data plane | 2026-04 | | Resend Labs Inc. | Transactional email | US (delivery via EU regions when available) | SCC + DPA | 2026-04 | | Functional Software, Inc. (Sentry) | Error monitoring | US (eu.sentry.io endpoint) | SCC + EU-resident project | 2026-04 | | Cloudflare, Inc. | DNS, DDoS protection, WAF | Global anycast | SCC + DPA | 2026-04 |

Pending or under evaluation

| Vendor | Purpose | Status | |---|---|---| | Slack Technologies, Inc. | Internal incident channel mirror | Evaluation Q3 2026 | | Linear Labs, Inc. | Internal issue tracker (no customer data) | Active, no customer data, not a subprocessor |

Customer-controlled providers (BYOK / BYOC)

These services are not BestCoder subprocessors when used through bring-your-own-key (BYOK) or bring-your-own-cloud (BYOC) — the contractual relationship is directly between you and the provider:

• AWS, Azure, GCP, Hetzner, Scaleway (BYOC for the data plane)
• Ollama, vLLM, llama.cpp (self-hosted inference)
• Any other LLM provider you connect via your own API key

Transfer mechanism summary

For every non-EU subprocessor we maintain:

1. Signed Standard Contractual Clauses (SCC) Module 3.
2. A documented Transfer Impact Assessment (TIA).
3. Encryption in transit (TLS 1.3) and at rest (AES-256).
4. EU-resident processing wherever the vendor offers it.

The full TIA pack is available on request to dpo@bestcoder.app.