Subprocessors

Infrastructure and hosting

Vercel hosts the web application and API — the compute and edge that serve Brad. Your requests pass through it, and some document upload and attachment traffic transits its functions; it is not the persistent store for your documents.

Supabase is our system of record: the database, file storage, and authentication that hold your documents, extracted content, accounts, and workspace data. It encrypts data at rest (AES-256) and connections in transit (TLS).

Cloudflare provides three things: edge infrastructure (DNS, CDN, routing) for traffic in transit; R2 object storage for inbound channel attachments and files ingested from any sources you connect, encrypted at rest with AES-256; and Turnstile, which protects signup from bots and sees only challenge tokens, not your project data.

AI inference and search

OpenAI and Anthropic provide the AI inference that reads your documents and generates answers, through their metered business APIs. Document content is sent for inference; inputs and outputs are not used to train their public models — that is their standard API policy.

An embeddings provider (such as Voyage, OpenAI, or Google) turns your documents into the search vectors that power retrieval. Document text is sent to the configured provider under that provider’s API terms.

Billing, communications, and background jobs

Stripe handles billing. It sees account and payment metadata — not your project documents.

Inngest orchestrates the background jobs that process your documents. Job payloads may include message text and metadata, document and tenant identifiers, and attachment references; it is not where your documents are stored.

Twilio powers phone verification for sign-in (one-time codes), through a dedicated verification service. It sees phone numbers.

Email is carried by two transports. Resend handles inbound document-forwarding and outbound transactional and account-notification email; AgentMail, when configured, is a preferred transport for outbound and programmatic mail. Between them they see email addresses and message content.

Sources you connect

If you connect one of your own systems to Brad — for example a cloud drive — that source is your integration, governed by your agreement with that provider, and is separate from the Brad-operated subprocessors listed above. We read from a source you connect only to bring your documents into your workspace.

How this list changes

This is a point-in-time list, dated above. When we add or remove a provider, we update this page and its date. A formal customer-facing change-notification process is something we’re still building; in the meantime, if you need to be told of changes for a contract or procurement requirement, ask us and we’ll arrange it.