1. Core infrastructure (always in the processing chain)
These process Customer Data for every account. They cannot be switched off without ending the Service.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Google Cloud Platform (Google Ireland Ltd.) | Application hosting, PostgreSQL databases, object storage for every uploaded document, event queues and key management — all Customer Data passes through | EU (europe-west1, europe-central2) | EU processing |
| Cloudflare, Inc. | DNS, DDoS protection and edge delivery. Sees request metadata (IP, user agent, URL); no application data at rest | Global edge network | SCCs + Cloudflare DPA |
| Cloudflare, Inc. — Turnstile | Bot challenge on sign-in, the demo account and the public help forms. Processes client signals: IP address, TLS fingerprint, user agent and the site key and origin (per Cloudflare's Turnstile privacy notice). Cloudflare also uses these signals as an independent controller to improve its bot detection | Global edge network | SCCs + Cloudflare DPA |
| Sentry (Functional Software, Inc.) | Error monitoring. PII scrubbing is enabled and emails, CUI, IBAN, card numbers, phone numbers and tokens are redacted before send; free-text in an error message can still contain names | EU (de.sentry.io) | EU processing |
| Brivio self-hosted mail (Stalwart) | Transactional email — recipient address, subject and body | EU (our own infrastructure) | No third-party transfer |
| Antivirus scanning service | Uploaded file bytes are scanned before storage. Self-hosted by default | EU (our own infrastructure) | No third-party transfer |
| Vercel Inc. | Hosting of the disaster-recovery console at recovery.brivio.ro and Web Vitals telemetry (route, timings, IP, user agent) | EU / US | Adequacy (EU–US DPF) + SCCs |
2. AI and document understanding
Engaged only when you use an AI feature or upload a document for extraction. Content sent for processing may contain any personal data present in that document or conversation.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| codai (Interactive Media Solutions S.R.L.) | AI inference gateway for assistant, extraction and drafting features. Receives the prompt content — document text, invoice and expense data, counterparty details, and message bodies where you invoke AI on them | EU | EU processing |
| Google Cloud Vertex AI (Anthropic models), via codai | Model execution behind the codai gateway. Contractually not used for training | EU (europe-west) | EU processing |
| Microsoft Azure AI Foundry, via codai | Secondary model backend behind the codai gateway. Contractually not used for training | EU | EU processing |
| Microsoft Azure AI Document Intelligence | OCR of uploaded invoices, receipts and identity documents. Receives the full document, returns names, addresses, tax ids and IBANs | EU | EU processing |
| Google Cloud Document AI (Google Ireland Ltd.) | OCR of identity documents scanned during company formation. Receives the document image and returns its printed text; synchronous processing, nothing stored by Google | EU (eu multi-region) | EU processing |
| OpenAI Ireland Ltd. (only if configured) | Fallback provider for AI features run automatically in the background, used only if configured; by default these requests go through the codai gateway. Receives the prompt content | EU / US | Adequacy (EU–US DPF) + SCCs |
3. Email delivery and mailbox access
Each provider is optional and used only if you configure it. All of them receive the full message: sender and recipient addresses, subject and body, including attachments.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Amazon SES (AWS EMEA SARL) | Bulk and transactional email delivery, bounce and complaint events | EU (eu-west-1) | EU processing |
| Brevo (Sendinblue SAS) | Marketing and transactional email delivery | EU (France) | EU processing |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery and delivery events | US | SCCs |
| Twilio SendGrid, Inc. | Transactional and campaign email delivery | US | SCCs |
| Mailgun (Sinch Email) | Email delivery | EU (eu.mailgun.net) / US | EU region where selected; otherwise SCCs |
| Google LLC — Gmail API | Mailbox synchronisation you authorise via OAuth. Scope is gmail.modify: message headers, bodies and attachments are read, and mail can be sent on your behalf | EU / US | Adequacy (EU–US DPF) + SCCs |
| Microsoft Corporation — Graph API | Mailbox synchronisation (Mail.ReadWrite, Mail.Send) and OneDrive/SharePoint file access you authorise via OAuth | EU (tenant region) / US | Adequacy (EU–US DPF) + SCCs |
| Your own mail server (SMTP/IMAP/POP3) | Where you connect your own host, that host — not Brivio — determines where your mail is stored | As configured by you | You control this transfer |
4. Messaging and SMS
Optional channels. Enabled per organisation.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Meta Platforms Ireland Ltd. — WhatsApp Business Cloud API | Sends and receives business messages: recipient phone number, template variables such as customer name, invoice number and amount, and inbound message text | EU / US | Adequacy (EU–US DPF) + SCCs |
| Telegram FZ-LLC | Bot notifications, assistant conversations and Mini App sign-in. Receives chat id, Telegram user identity and the full notification body | United Arab Emirates | SCCs — no adequacy decision for the UAE; opt-in only |
| Twilio Ireland Ltd. | SMS delivery including one-time codes: recipient number and message text | EU / US | Adequacy (EU–US DPF) + SCCs |
| SMSO (Andra Media S.R.L.) | SMS delivery in Romania: recipient number and message text | Romania | EU processing |
| Cloudflare, Inc. — Realtime (TURN) | Relay for in-app audio and video calls, used only when a direct connection between participants is not possible. Sees participants’ IP addresses; media passes through encrypted (DTLS-SRTP) and is not stored | Global edge network | SCCs + Cloudflare DPA |
5. Payments
Card data is entered on the provider’s own hosted page and never reaches Brivio’s systems.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. | Subscription billing and card acceptance: payer name and email, billing address, invoice description. Under Stripe Connect, merchant identity and payout bank details are collected directly by Stripe for KYC | EU / US | Adequacy (EU–US DPF) + SCCs |
| Netopia Payments S.R.L. | Card acceptance for storefront orders: buyer name and email, order description | Romania | EU processing |
| PayU S.A. (Romania branch) | Card acceptance for storefront orders: buyer email, first name, buyer IP address, order description | EU (Poland/Romania) | EU processing |
| EuPlătesc (Euplatesc.ro S.R.L.) | Card acceptance for storefront orders: order reference and amount only | Romania | EU processing |
6. Open banking (only at your initiative)
Engaged when you connect a bank account. They return account holder names, IBANs, balances and transaction narratives that frequently name individuals.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Salt Edge Ltd. | Account aggregation and payment initiation under PSD2 | EU / UK | UK adequacy decision (renewed 19 December 2025, valid to 27 December 2031) |
| GoCardless Ltd. (Bank Account Data) | Account aggregation under PSD2 | EU / UK | UK adequacy decision (as above) |
| Revolut Bank UAB | Business account aggregation | EU (Lithuania) | EU processing |
| Libra Internet Bank S.A. | Account data via the bank’s own gateway, where you hold an account there | Romania | EU processing |
| Smart Fintech S.R.L. (Smart Accounts) | Account aggregation under PSD2 for Romanian banks (payment institution authorised by the National Bank of Romania, IP-RO-0011): account list, IBAN, balances and transactions, only on your consent | Romania | EU processing |
7. Shipping and logistics
Engaged when you create a shipment. Each carrier receives what a courier needs to deliver: sender and recipient name, full address, telephone, email, parcel description and any cash-on-delivery amount.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Urgent Cargus S.A. | AWB creation and tracking | Romania | EU processing |
| DPD România S.R.L. | AWB creation and tracking | Romania | EU processing |
| FAN Courier Express S.R.L. | AWB creation and tracking | Romania | EU processing |
| General Logistics Systems România S.R.L. | AWB creation and tracking | Romania | EU processing |
| Sameday (Delivery Solutions S.A.) | AWB creation and tracking | Romania | EU processing |
8. Fleet telematics
Engaged only if you connect a telematics unit. See also the employee monitoring section of the Privacy Policy.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Traccar server (self-hosted or your provider) | Vehicle position, speed, ignition state and odometer. Where a driver is assigned to the vehicle, this is personal data about that driver | As configured by you | You control this transfer |
9. Electronic signature and identity
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Evrotrust Technologies AD | Qualified electronic signature and identity verification: the document to be signed, the signer’s name and national identifier, and the certificate details | EU (Bulgaria) | EU processing |
| Stripe Payments Europe Ltd. — Stripe Identity | Optional identity verification (KYC and owner account recovery): a photo of a government-issued ID document and a live selfie matched against it (biometric data). Brivio keeps only the outcome, the document's issuing country, the birth year and whether the name matches; after the decision the session is redacted at Stripe | EU / US | Adequacy (EU–US DPF) + SCCs |
10. Electronic invoicing networks
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Peppol Access Point | Delivery of electronic invoices to EU trading partners. Carries the full invoice: buyer and supplier legal name, address, VAT id and contact person | EU | EU processing |
11. Domains, websites and storefront delivery
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| Hosting Concepts B.V. (OpenProvider) | Domain registration, if you register a domain through us. Registry rules require registrant name, company, email, telephone and postal address | EU (Netherlands) | EU processing |
| Brandfetch B.V. | Company logo images rendered in your browser. Brandfetch sees the visitor’s IP address and user agent, not account data | EU (Netherlands) | EU processing |
| Google LLC — favicon service | Company logo images rendered in your browser when Brandfetch is not configured. Google sees the visitor’s IP address and user agent and the domain of the company shown, not account data | EU / US | Adequacy (EU–US DPF) + SCCs |
| OpenStreetMap Foundation | Map tiles rendered in your browser on map screens. Sees the visitor’s IP address and the viewport requested | EU / UK | UK adequacy decision |
| Google LLC — Sign in with Google | Optional sign-in. Google issues an identity token containing your name, email address and profile picture, and learns that you visited the sign-in page | EU / US | Adequacy (EU–US DPF) + SCCs |
12. Business information sources
These are queried about companies, not about you. They can nevertheless return the names of administrators, shareholders and contact persons, who are natural persons.
| Provider | Purpose and personal data | Location | Transfer mechanism |
|---|---|---|---|
| FirmeAPI | Company lookup by tax identification number; returns administrator and shareholder names | Romania | EU processing |
| Shopify International Ltd. | Storefront order synchronisation, if you connect a Shopify store: end-customer name, address, email and telephone | EU (Ireland) / Canada | Canada adequacy decision + SCCs |
| Google LLC — Calendar and Drive APIs | Calendar synchronisation (event titles, attendee addresses) and access to files you explicitly pick | EU / US | Adequacy (EU–US DPF) + SCCs |
| Dropbox, Inc. — Dropbox API (optional) | Access to files you explicitly pick, only if you connect your Dropbox account through the cloud-storage integration | EU / US | Adequacy (EU–US DPF) + SCCs |
13. Public authorities and public data sources (not sub-processors)
| Entity | Role |
|---|---|
| ANAF (SPV, e-Factura, e-Transport) | Independent public authority. Receives fiscal documents at your instruction; e-Transport declarations additionally carry the driver name and vehicle registration |
| Inspecția Muncii (REGES/REVISAL) | Independent public authority. Receives employment register data including employee name and CNP, at your instruction |
| BNR | Public exchange-rate source. No personal data transmitted |
| ONRC / data.gov.ro | Public company registry data (monthly open datasets). May return administrator and shareholder names |
| Ministry of Finance / ANAF — financial statements | Indicators from filed balance sheets. Contain no personal data |
| Official sanctions lists (EU, OFAC, UK, UN) | Matched by company identifier only, never by name |
| ONRC RECOM (only when configured) | Paid ONRC service: registry entries and secondary offices. May return shareholder names |
| Portalul instanțelor și legislatie.just.ro | Public case and legislation data. May return the names of parties to litigation |
| SEAP / TED | Public procurement notices. May contain contact persons |
| No other source | We do not collect company data by automated extraction (scraping) from third-party commercial directories |
14. Change notifications
Subscribe to sub-processor change notifications by emailing privacy@brivio.ro with the subject "Sub-processor updates". Material additions are announced at least 30 days before the new sub-processor begins processing Customer Data, and you may object under the DPA.
Providers listed as optional receive nothing until the corresponding integration is enabled in your organisation. Disabling an integration stops further transfers; it does not retroactively erase data already held by that provider, which is governed by their own retention terms.