Sub-processors
Last updated: 2026-04-18. The full list of third parties that help run Brily, what they do, where they operate, and how cross-border transfers are covered. We announce additions by email 30 days in advance.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Primary infrastructure: application servers, database, object storage. All customer-facing workloads run here. | Germany, Finland | Intra-EEA, no transfer mechanism required |
| Cloudflare, Inc. | CDN, DNS, DDoS mitigation, edge caching for the marketing site and status pages. | United States (global edge) | EU SCCs + DPF certification |
| Stripe Payments Europe | Payment processing, invoicing, tax calculation. Full card numbers never reach our systems. | Ireland | Intra-EEA |
| Postmark (ActiveCampaign) | Transactional email delivery: account notifications, status page subscriber emails, NPS surveys. | United States | EU SCCs + DPF certification |
| Sentry | Application error tracking. We scrub PII from payloads before submission. | United States (EU region for our instance) | Intra-EEA for EU-region deployment |
| Plausible Analytics | Privacy-respecting marketing-site analytics. Cookie-free, IP-anonymised, no cross-site tracking. | Germany | Intra-EEA |
| Google Workspace | Internal business operations: email, documents, calendar. No customer production data is stored in Workspace. | Ireland (EU region) | EU SCCs + DPF certification |
What counts as a sub-processor
Any third-party service that processes personal data on our behalf. Infrastructure providers, email senders, analytics, error trackers, payment processors, internal tooling — all in scope. Services that process only our employees' data (payroll, expense) are not on this list; they are covered by our internal HR privacy notice.
How to subscribe to changes
Every account admin automatically receives 30-day advance notice of additions by email. You can opt additional recipients in via legal@brily.app. You can also watch this page — we keep it in sync with the announcement email.
How to object
If you object to a new sub-processor in good faith, email legal@brily.app within the 30-day notice window. We'll either find an alternative or work with you on a transition plan. If neither is workable, you may terminate the affected service on notice, with a pro-rated refund of any prepaid fees.
Transfer impact assessments
Before onboarding a sub-processor that introduces a new jurisdiction, we run a transfer impact assessment against the EDPB guidelines. Summary findings are available to customers under NDA.