Services and vendors
The services BeeSensible uses for detection, hosting, login, billing and email, and what each service gets to see.
Detection runs on BeeSensible's own models, not on a third-party AI service. The services below support hosting, login, billing, email and support.
In the detection path:
| Service | Use | Location |
|---|---|---|
| Scaleway | Hosting of the API, dashboard, database, object storage, the login environment (Keycloak) and the service that anonymises documents | EU (Netherlands; object storage and registry also in France and Poland) |
| Hetzner | Compute for detection and for sorting prompts into use-case categories | EU (Germany) |
Both are European companies, not the European arm of an American provider. Scaleway is 96% owned by the French Iliad group; Hetzner Online GmbH is based in Germany. Both are ISO/IEC 27001:2022 certified.
Supporting services:
| Service | Use | Location |
|---|---|---|
| Google / Microsoft | Identity providers for single sign-on (SSO), used only at the moment of signing in | US |
| Paddle | Billing, subscriptions and seats (Merchant of Record) | UK (adequacy decision) |
| Brevo | Invitations, welcome emails and reminders, the AI register review email and the Inbox email about new tools; a contact list of free users (email address and first name) for product emails, cleared as soon as the organisation pays or the account is deleted | EU (France) |
| Slack | Messages from the contact form, internal alerts about how the service is running (counts only) and a notification when a new organisation is created (name, email domain, seats, plan) | US |
| Cloudflare | CDN, security and cookieless analytics for the website; not involved in the product | US |
| Proton | Our own mailbox for customer correspondence; not involved in the product | Switzerland (adequacy decision) |
| GitHub | Source code, build pipeline and hosting of our software images; no user data | US |
Keycloak, the service users sign in through, is self-hosted in our own environment at Scaleway. It is not a third party. If an organisation links its own identity provider, that is its own choice.
Typed text, documents and prompts reach only Scaleway and Hetzner, and only in working memory there: Scaleway hosts the API and the document service that processing passes through; Hetzner runs the detection. The other services do not see them.
The formal data processing agreement (DPA), DPIA and subprocessor list are authoritative. Email trust@beesensible.eu for the current versions.
