Subprocessor List
The third-party providers that help us operate Brewstiller, and the data each handles.
Last updated: July 4, 2026
What this document is
A "subprocessor" is a third-party service provider that processes data on Brewstiller's behalf in connection with operating the platform. This list names each subprocessor, the service it provides, and the categories of data it handles. It is referenced by the Privacy Policy (§6.1), the Terms of Service (§14), and the DPA (Annex B).
How we notify you about changes
- This page is updated with the planned change, its effective date, and the data the new or replaced subprocessor will process.
- Email notice to each affected Commercial Workspace's owner (or a designated notifications contact — set one via the customer portal or [email protected]).
- At least 30 days' notice before the change takes effect — except emergency replacements needed for availability or security, where notice is given as soon as practicable, with explanation.
Objection rights (Commercial Customers): object on legitimate data-protection grounds within 30 days of notice; we discuss in good faith; if unresolved, you may terminate the affected portion (or the subscription, if inseparable) effective when the new subprocessor would begin processing, with prorated refund of prepaid fees. Details: DPA §5.4. Hobby customers have no formal DPA objection right but may terminate before a change takes effect (standard 30-day hobby deletion follows).
Current subprocessors
Clerk — authentication
| Field | Value |
|---|---|
| Legal entity | Clerk, Inc. |
| Service | Authentication and identity — sign-in, MFA, session management, social sign-in, user-profile data |
| Status | Active |
| Data processed | Account credentials (email, password hash, OAuth identifiers, MFA credentials); session tokens and metadata; basic profile (first name, optional display name); sign-in event metadata (IP, user agent, location) for security |
| DPA-covered Customer Personal Data? | Yes — commercial workspace personnel with accounts |
| Location | United States (primary) |
| Vendor documentation | Privacy: clerk.com/privacy · DPA: clerk.com/legal/dpa · Security: clerk.com/legal/security |
| Certifications | Per vendor's public documentation |
DigitalOcean — cloud infrastructure (hosting, database, object storage)
| Field | Value |
|---|---|
| Legal entity | DigitalOcean, LLC (one subprocessor; three services) |
| Services | (a) App Platform — application hosting for the web service and the background-worker service; all in-transit request/response data passes through it; managed TLS and CDN for app static assets. (b) Managed PostgreSQL — the primary operational database; all hot operational data, audit logs, sensor aggregates, compliance records. (c) Spaces — S3-compatible object storage; file attachments (PDFs, photos, COAs, label images), Story Page imagery, cold-tier archive bundles, encrypted backups. |
| Status | Active |
| Data processed | All operational Customer Data submitted to the Service — comprehensively; every category described in Privacy Policy §4 and DPA Annex A is stored or transits on DigitalOcean infrastructure |
| DPA-covered Customer Personal Data? | Yes — comprehensive |
| Location | United States (SFO3 region) |
| Vendor documentation | Privacy: digitalocean.com/legal/privacy-policy · DPA: digitalocean.com/legal/data-processing-agreement · Trust: digitalocean.com/trust |
| Certifications | Per vendor's public documentation |
Resend — transactional email
| Field | Value |
|---|---|
| Legal entity | Resend, Inc. |
| Service | Transactional email delivery — invites, alert-rule notifications, security notices, billing and lifecycle notices, support correspondence; opt-in product announcements flow through the same service |
| Status | Active |
| Data processed | Recipient and sender addresses; subject; message content (may include a recipient's name, batch/sensor references in alerts, billing amounts); delivery/bounce/complaint events |
| DPA-covered Customer Personal Data? | Yes — where message content includes it |
| Location | United States |
| Vendor documentation | Privacy: resend.com/legal/privacy-policy · DPA: resend.com/legal/dpa · Security: resend.com/security |
| Certifications | Per vendor's public documentation |
Sentry — error tracking
| Field | Value |
|---|---|
| Legal entity | Functional Software, Inc. d/b/a Sentry |
| Service | Error tracking and performance monitoring for production/staging environments. Deployment posture: the integration is environment-gated — it is armed only in production/staging by explicit configuration and is a strict no-op elsewhere. Session replay is disabled by default and enabled only per-workspace on explicit opt-in via support. |
| Status | Active (environment-gated: production/staging only) |
| Data processed | Error events with technical context (browser/route/stack traces, brief action breadcrumbs); performance traces. Sensitive fields (passwords, tokens, card data, PII fields) are scrubbed via SDK configuration before transmission. With opt-in replay: interaction recordings with sensitive fields masked. |
| DPA-covered Customer Personal Data? | Limited/incidental — errors are about software, not people; a name visible on an erroring screen may appear in captured context. Replay (opt-in) captures more, which is why it is opt-in. |
| Location | United States (sentry.io US infrastructure) |
| Vendor documentation | Privacy: sentry.io/privacy · DPA: sentry.io/legal/dpa · Trust: sentry.io/trust |
| Certifications | Per vendor's public documentation |
Stripe — payments (engaged from the launch of paid tiers)
| Field | Value |
|---|---|
| Legal entity | Stripe, Inc. |
| Service | Payment processing, subscription billing, tax calculation (Stripe Tax), customer billing portal, invoicing, payment-method storage |
| Status | Committed — engaged when paid tiers launch. Until then, no customer data flows to Stripe. This entry is published in advance so its engagement is not a surprise change. |
| Data processed (once engaged) | Billing address; tax IDs / exemption references; subscription and invoice history; payment-method data (full details held by Stripe — Brewstiller receives only tokens and metadata: brand, last four, expiration) |
| DPA-covered Customer Personal Data? | Limited — billing-contact details |
| Location | United States (primary) |
| Vendor documentation | Privacy: stripe.com/privacy · DPA: stripe.com/dpa · Security: stripe.com/security |
| Certifications | Per vendor's public documentation (incl. PCI DSS Level 1) |
Services that are NOT subprocessors
For completeness — services in the operational picture that do not process customer personal data on our behalf:
- UptimeRobot (availability monitoring) — pings public endpoints and powers the status page; sees only public URLs and response codes, no customer data.
- GitHub (source code and CI) — holds our code, never customer data.
- Local development tools (MinIO, Mailpit) — development-only stand-ins that never touch production customer data.
- Your own integrations — services you connect (your accounting software, your sensor vendor's cloud with your credentials) act for you under your agreements with them, not as our subprocessors. If Brewstiller later operates a vendor integration on its own credentials on your behalf, that vendor becomes a subprocessor and appears above with notice.
- TTB, FDA, state regulators, tax authorities — regulated recipients of submissions you make; not subprocessors.
- Transfer-in-bond counterparties — receive the transfer data regulation requires; not subprocessors.
Anticipated future subprocessors
Engagement of any of these will follow the 30-day-notice process:
- Product analytics platform (e.g., PostHog) — deferred; product analytics is currently first-party in our own database.
- Sensor cloud APIs (Plaato, Brewbrain, RAPT, etc.) — become subprocessors only if Brewstiller polls on your behalf under a Brewstiller-managed integration (see above).
- International data-residency providers — with international expansion.
- AI inference providers (Anthropic, OpenAI, or similar) — only if and when AI features ship; per Terms §9.3, Customer Data is never used to train third-party models without explicit opt-in consent; any engagement would be inference-only processing.
Sub-subprocessors
Our subprocessors engage their own providers (e.g., a cloud vendor's underlying infrastructure, Stripe's banking partners). We do not list sub-subprocessors; each subprocessor's own DPA governs them — see their linked documentation.
Version history
| Version | Effective date | Summary |
|---|---|---|
| v1.0 | — (never published) | Initial draft. |
| v1.1 | July 4, 2026 | DigitalOcean consolidated; Status field added (Stripe pre-engagement); Sentry deployment posture stated accurately; non-subprocessor services documented. |
Questions
[email protected] (DPA/commercial) · [email protected] (general privacy).