Sub-processors
Last updated: October 28, 2026
Brainis engages the sub-processors below to help deliver the Services. We require all sub-processors to commit to data-protection obligations equivalent to those in our Data Processing Agreement.
We will give customers at least 30 days' notice of any new sub-processor by updating this page and notifying customers who have subscribed to sub-processor change alerts. To subscribe, email support@brainis.ai.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Supabase | Primary database, authentication, file storage, server functions | All customer data | United States (AWS us-east-1) |
| Vercel | Hosting and delivery of brainis.ai and app.brainis.ai | Request metadata (IP address, browser, pages requested) in hosting logs | United States; global edge network |
| Anthropic | AI model inference (reasoning and review steps of AI features) | User prompts and selected context (governed by each organisation's AI settings) | United States |
| Google (Gemini API) | AI model inference for everyday AI features, and text embeddings for search and knowledge retrieval | User prompts and selected context; content being indexed (documents, articles, records) | United States |
| OpenAI | AI model inference for some AI features, live voice conversations and the spoken audio brief | User prompts and selected context; voice audio during a live voice session; the text of a brief read aloud | United States |
| Stripe | Payment processing and subscription management | Billing contact, payment metadata (no card data stored by Brainis) | United States / EU |
| Resend | Transactional email delivery (brainis.ai) | Recipient email, message content | United States (AWS us-east-1) |
| hCaptcha (Intuition Machines, Inc.) | Telling a person from an automated script on sign-in and on public forms | IP address and browser signals, at the moment of the check | United States |
| Sentry | Application error monitoring | Error reports with the page and browser; no names, email addresses, headers or cookies are sent | United States |
| PostHog | Product analytics and masked session replays on the website and in the app (on by default outside Europe until you say no; in Europe only after you accept; on the website, never with Global Privacy Control or Do Not Track) | Pseudonymous usage events; form inputs, money and people data masked | United States |
| Google (Analytics 4, Google Ads) | Analytics and advertising measurement on the website and in the app (on by default outside Europe until you say no; in Europe only after you accept; with Global Privacy Control, advertising storage is refused) | IP-truncated page views, pseudonymous identifiers, campaign identifiers, the sign-up and payment conversions | United States / EU |
| Microsoft Clarity | Usage insight on the website and in the app (on by default outside Europe until you say no; in Europe only after you accept) | Pseudonymous session metadata | United States / EU |
| Meta Platforms (Meta pixel) | Advertising measurement on the website, and of sign-ups and payments in the app (on by default outside Europe until you say no; in Europe only after you accept; never with Global Privacy Control) | Pseudonymous identifiers, pages visited, the sign-up and payment conversions | United States |
| X Corp. (X pixel) | Advertising measurement on the website, and of sign-ups and payments in the app (on by default outside Europe until you say no; in Europe only after you accept; never with Global Privacy Control) | Pseudonymous identifiers, pages visited, the sign-up and payment conversions | United States |
For questions about a specific sub-processor or to object to a new sub-processor on reasonable data-protection grounds, contact support@brainis.ai.