Services and vendors
The services BeeSensible uses for detection, hosting, login, billing, and email, and what each service gets to see.
Sensitive-data detection runs on BeeSensible's own models, not on a third-party AI service. The services below support hosting, login, billing, email, and support.
In the detection itself:
| Service | Use | Location |
|---|---|---|
| Scaleway | Hosting of the API, dashboard, database, object storage, the login environment (Keycloak), and the service that anonymises PDFs | EU (Netherlands; object storage and registry also France and Poland) |
| Hetzner | Compute for detection and for sorting prompts into use-case categories | EU (Germany) |
Both are European companies rather than the European arm of an American provider: Scaleway is 96% owned by the French Iliad group, and Hetzner Online GmbH is based in Germany. Both are ISO/IEC 27001:2022 certified.
Around the service:
| Service | Use | Location |
|---|---|---|
| Google / Microsoft | Identity providers at sign-in (SSO), only at the moment of signing in | US |
| Paddle | Billing, subscriptions, and seats (Merchant of Record) | UK (adequacy decision) |
| Brevo | Invitations, welcome emails, and reminders; a contact list of free users (email address and first name) for product emails, cleared as soon as the organisation pays or the account is deleted | EU (France) |
| Slack | Messages from the contact form, internal notices about how the service is running (counts only), and a notice when a new organisation is created (name, email domain, seats, plan) | US |
| Cloudflare | CDN, security, and cookieless analytics for the website; not involved in the product | US |
| Proton | Our own mailbox for customer correspondence; not involved in the product | Switzerland (adequacy decision) |
| GitHub | Source code, build pipeline, and hosting of our software images; no user data | US |
Keycloak, which users sign in through, runs self-hosted inside our own environment at Scaleway and is not an outside party. If an organisation links its own identity provider, that provider is the organisation's own choice.
None of these services gets to see typed text, documents, or prompts. Hetzner sees them only in working memory during detection in cloud mode, and Scaleway hosts the API that the same processing passes through.
For a formal data processing agreement, DPIA, or sub-processor list, the legal documentation is authoritative. Email [email protected] for the current documents.
