Infrastructure and AI
| Service | Use and information | Provider information |
|---|---|---|
| Vercel | Website hosting, server execution, background workflows and operational logs. Handles requests and information needed to run the application. | DPA and transfer provisions |
| Neon / Databricks | Database, account authentication and sessions, including sign-in email delivery through the authentication service. Stores application records and identities. | Current Neon service terms · Privacy information |
| OpenAI | Requested AI research, document extraction and analysis. Receives relevant input evidence and public-search context. | DPA · API data and retention |
These services operate internationally, including the United States and EEA. Their published terms describe onward processing and transfer safeguards. The applicable entity and region can depend on the account/service; a directory entry is not a promise that every listed region or retention option is configured for this account.
Payments, connected services and public sources
Stripe: processes payments and related customer/transaction details when used. It has both processor and independent-controller purposes, including fraud prevention and legal compliance. See Stripe’s DPA and privacy notice. Workspace reports are not required payment metadata.
Accounting connections: if you connect a supported accounting provider, its authorisation screen identifies the requested access and organisation. Its own terms apply. Disconnecting does not delete data already imported into the workspace.
Companies House and public websites: supply research material. They are not automatically our subprocessors simply because we retrieve public information. Search and website requests may disclose public query or connection information.
Google Fonts: some shared page styles request external font files, exposing browser connection information to Google. See Google Fonts privacy information. This is separate from our account-linked usage measurement.
General email is a separate correspondence channel. This directory does not claim that a particular future mailbox provider is already configured. Use the signed-in support form if email delivery is unavailable; replies to those tickets appear in the application.
Agreed register and changes
For a Business Desk agreement, request the applicable recipient entities, processing/support countries, retention and safeguards from support@brighterdesk.com. Do not infer UK-only processing from the application’s hosting region. The DPA requires a binding provider arrangement and lawful transfer mechanism before customer personal data is processed.
Where incorporated into a business agreement, the DPA provides advance notice and a reasonable objection process for new or replacement subprocessors. A supplier’s certification is not a certification of treleto. Provider links are information sources, not evidence that an account-specific contractual or security review has been completed.
Questions about this document? support@brighterdesk.com