Subprocessors

Current service providers

• Railway — application hosting and runtime infrastructure.
• Supabase — hosted PostgreSQL database, authentication and private object storage.
• Backblaze B2 — offsite storage of client-side encrypted backup archives and recovery ledgers; backup decryption keys are retained separately.
• GitHub — private source hosting and independent recovery integrity/version metadata. The recovery metadata does not contain the underlying customer records or private signing keys.
• Resend — transactional email delivery, inbound support email and delivery events.
• Cloudflare Turnstile — bot and abuse resistance on public authentication forms.
• Namecheap — domain registration, DNS and forwarding for Brakan addresses.
• Stripe — subscription checkout, payment processing, billing portal and payment-status events. Payment details are entered on Stripe-hosted pages, not stored as card numbers by Brakan.

Conditional providers

• HMRC — tax API authority and filing services, only after customer authorisation and production approval.
• An authorised Open Banking account-information provider — only after selection, contracting and explicit customer consent. No live provider is currently enabled.

General written authorisation

When the Data Processing Terms become part of a customer’s Services Agreement, the customer gives Brakan general written authorisation to use the providers listed here for the stated purposes.

Changes and objections

Brakan will give at least 30 days’ notice before an intended addition or replacement that processes Customer Personal Data. A customer may object during that period on reasonable data-protection grounds. Brakan will work in good faith to address the objection, including by proposing a commercially reasonable alternative where available. If the parties cannot resolve it, the customer may terminate the affected service without penalty before the change takes effect. A shorter period may be used only where urgent security, legal or provider-continuity circumstances make 30 days impracticable; Brakan will explain the reason and give as much notice as it lawfully can.

Contracts and responsibility

Brakan will appoint each subprocessor under a written contract imposing the same data-protection obligations that apply to Brakan under the Data Processing Terms, to the extent applicable to that processing. Brakan remains responsible to the customer for the subprocessor’s performance of those obligations.

Locations and transfers

Verified processing locations, restricted-transfer roles and safeguards must be entered in the International Transfer Schedule before paid launch. The current list identifies providers but is not evidence that transfer due diligence or documentation has been completed.