Brainbox Subprocessors
Last updated 2nd November 2026
These are the companies that process personal data on behalf of Roundapproach, Lda. to run Brainbox. Your workspace runs on its own server in Germany. Some providers below, notably AI model providers, may process data outside the EEA, under the safeguards shown.
We email account administrators at least 30 days before adding or replacing a sub-processor, and update this page. Questions: hello@mybrainbox.ai.
Infrastructure
| Provider | Purpose | Data processed | Location | Safeguard | Certifications |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of your dedicated workspace server and our application, and daily backups | Workspace content, account data | Germany | EU | ISO 27001:2022 |
| Neon (Databricks, Inc.) | Account database | Account, organisation, billing and credit-usage records | Germany (AWS Frankfurt) | EU hosting; SCCs for US support access | SOC 2 Type 2, ISO 27001, ISO 27701 |
| OVH SAS (OVHcloud) | HSM-backed key management for encrypting stored credentials | Encryption keys only | France | EU | ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701 |
| Cloudflare, Inc. | DNS and network protection | Network traffic and technical data | Global network | EU–US Data Privacy Framework / SCCs | ISO 27001:2022, ISO 27018, ISO 27701, SOC 2 Type 2 |
| Resend (Plus Five Five, Inc.) | Sign-in and notification emails | Email addresses and message contents | Ireland (EU) | EU sending region; SCCs for US support access | SOC 2 Type 2 |
| Functional Software, Inc. (Sentry) | Error monitoring | Error diagnostics, minimised | Germany (EU region) | EU hosting; SCCs for US support access | SOC 2 Type 2, ISO 27001 |
| InvoiceXpress, Lda. | Invoicing | Billing contact and invoice data | Portugal | EU | ISO 27001 (per provider) |
Certifications are those published by each provider and belong to that provider, not to Roundapproach. Each link goes to the provider's own source.
AI processing
You choose how Brainbox runs AI models for your organisation:
- Brainbox AI credits. You use models provided by Brainbox, paid with your credits. This is the only option where the providers below process data on our behalf, which is why they're listed here.
- Your own API keys. On request, we can set your Brainbox to use your own account with an AI provider. Requests then run on your account, under your agreement with that provider, not on our behalf.
- Your own models. On request, we can connect Brainbox to a model you host or contract directly, for example one hosted in the EU.
When you use Brainbox AI credits, your administrators decide how requests are handled:
- Zero data retention. Require that requests only go to provider endpoints that don't store your data, for your whole organisation or for individual Coworkers.
- Providers. Limit which model providers may serve your requests.
- Models. Choose which models your users can select.
The content needed to answer a request (the prompt, and any files, emails or records the Coworker includes) is sent from your workspace to OpenRouter, which forwards it to a provider your settings allow. OpenRouter, Inc. is a US company, so it handles your requests even when the model provider is in the EU. The reply comes back to your workspace, where it is stored. Roundapproach never uses it to train AI models. The providers handle it under their own terms and data policies.
| Provider | Purpose | Data processed | Location | Safeguard | Certifications |
|---|---|---|---|---|---|
| OpenRouter, Inc. | Routing each request to an allowed provider, and usage accounting | Prompts, model inputs and outputs, usage metadata | United States | Per OpenRouter's terms | SOC 2 Type 2 |
| Model providers available through OpenRouter, as your settings allow | Running the selected model | Model inputs and outputs, including images you upload or generate | Varies by provider and model: some in the EU, many in the United States | Per provider; see the OpenRouter provider list | Varies by provider |
The models currently available, with their providers, are listed in the app under Models. Each provider's retention follows its own data policy, which OpenRouter shows per provider.
Not our sub-processors
- Apps you connect, such as Google Workspace, Microsoft 365, Notion or LinkedIn. Each connection uses your own credentials or OAuth apps, under your agreement with that provider, and Brainbox exchanges data with them only on your instructions.
- AI providers and models you use with your own API keys or contracts (for example your own OpenRouter account). That provider works for you under your contract with it.
- Personal AI subscriptions your users connect, such as ChatGPT (OpenAI) or GitHub Copilot. Requests using those models run on that user's own account, under the terms that user has accepted with the provider. Depending on the plan and its settings, the provider may use the data to improve its models.
- AI apps you connect to Brainbox through MCP, such as Claude, ChatGPT or Microsoft Copilot. They receive the information they request through Brainbox and process it under your or your users' agreements with their providers.