These are the third parties that can touch customer or recipient data, what each one touches, and where it runs. The list forms part of the Data Processing Addendum as Annex III.
Current sub-processors
| Provider | What it does | What it can reach | Where | Since |
|---|---|---|---|---|
| Anthropic, PBC | AI field mapping, form generation, exam detection and Spanish translation | PDF AcroForm field names, form labels, option text and exam question text. Never the answers a recipient submits, never an uploaded file. | United States | Jan 2026 |
| Stripe, Inc. | Subscription billing, checkout, invoices and payment-method storage | Billing contact name and email, company name, card details (collected by Stripe, never stored by us), invoice history | United States, with global processing | Jan 2026 |
| Transactional email provider | Delivery of portal links, invitations, payment links and system notifications | Recipient name and email address, the message body and any single-use link it carries | United States / European Union | Jan 2026 |
| Hetzner Online GmbH | Application hosting, database and file storage | All service data at rest, including uploaded PDF templates, generated documents and encrypted fields | European Union (Germany) | Jan 2026 |
| Google LLC — Places / Maps JavaScript API | Optional address autocomplete inside a form, only where the feature is configured | The partial address text typed into an address field and the browser IP address | United States | Jan 2026 |
Your own storage provider is not on this list, on purpose
When you connect your organization's Google Drive, Microsoft OneDrive or your own S3 bucket so that requested files land there, that provider is yours. We write into it on the authorization you grant and with the narrowest permission scope the provider offers; the account, the agreement, the file content and the provider's own handling of it are between you and them. It is not a sub-processing relationship of ours, and listing it here would misstate who is responsible for what.
Asset hosts
Our pages load fonts and a few libraries from public content delivery networks. They receive no customer or recipient data — but a browser that fetches a file from them discloses its IP address, which is personal data in the European Union, so they are named here:
- fonts.googleapis.com / fonts.gstatic.com (web fonts)
- cdn.jsdelivr.net (PDF viewer and alert library)
- cdnjs.cloudflare.com (support libraries)
Changes to this list
We give at least 30 days' notice before adding or replacing a sub-processor, by email to each account administrator and by updating this page. A customer may object on reasonable data-protection grounds within that period; section 7 of the DPA says what happens then.
To be notified of changes, write to privacy@branfillable.com.