Legal
Subprocessors
Last updated: June 2026
BugBrain engages the third-party subprocessors below to provide the service. Each is bound by a data-processing agreement and processes personal data only on our instructions. This list supports our Privacy Policy and Data Processing Agreement.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloud hosting (VPS) | Application + database hosting | All platform data (encrypted at rest/in transit) | Singapore (AP) | SCCs where applicable |
| AWS S3 | Object storage for test artifacts, reports, backups | Screenshots, logs, reports, DB backups | ap-southeast-1 (Singapore) | SCCs where applicable |
| Anthropic | AI models that analyze applications under test | Page content / snapshots sent for analysis (minimized) | United States | DPF / SCCs + TIA |
| Google Cloud (Vertex AI) | AI models (Gemini) for analysis + judging | Page content / run data sent for analysis (minimized) | United States / configurable | DPF / SCCs + TIA |
| Amplitude | Product analytics + session replay (consent-gated) | Anonymous device id, usage events, replays | United States (EU endpoint configurable) | DPF / SCCs + TIA |
| Google Analytics | Website usage analytics (consent-gated; ad features off) | Anonymous usage events, device info, approximate location | United States / EU | DPF / SCCs + TIA |
| Intercom | In-app support chat (consent-gated) | User id, email, name, role, plan, chat messages | United States / EU | DPF / SCCs + TIA |
| Polar | Billing / merchant of record | Name, email, plan, invoices | United States / EU | DPF / SCCs |
| Google Workspace (SMTP relay) | Transactional email delivery | Recipient email + message content | United States / EU | DPF / SCCs |
| GitHub | PR Automation (optional, when connected) | Repository + pull-request metadata and diffs | United States | DPF / SCCs |
Notification of changes
We update this page when we add or change a subprocessor. To be notified in advance of changes (as contemplated by GDPR Art 28(2)), email privacy@bugbrain.tech to subscribe. You may object to a new subprocessor as set out in our DPA.