Subprocessors
Our Authorized Data Subprocessors
Last updated: February 24, 2026
This page lists BBos's authorized Subprocessors as referenced in our Data Processing Addendum (DPA). These third-party service providers help us deliver our services while maintaining the highest standards of data protection.
CURRENT SUBPROCESSORS
BBos currently uses the following Subprocessors to Process Personal Data:
| Subprocessor Name | Service Provided | Processing Location | Description |
|---|---|---|---|
| Google Cloud Platform (Firebase) | Cloud hosting, database, storage, authentication | United States, with global CDN | Primary infrastructure provider for hosting, data storage, and authentication services |
| Google Cloud Platform (Vertex AI) | Artificial intelligence services | United States | AI-powered features including document analysis, content generation, chatbots, and speech-to-text, hosted on our own Google Cloud infrastructure |
| Twilio Inc. | Communications services | United States | Voice calling, video calling, SMS, and WhatsApp Business messaging |
| Intuit Inc. (QuickBooks) | Accounting integration | United States | QuickBooks Online integration for financial data synchronization |
| Plaid Inc. | Banking data integration | United States | Bank account linking, transaction synchronization, and balance verification for accounting features |
| Stripe Inc. | Payment processing | United States | Payment link generation, invoice payment processing via Stripe Connect, and webhook-based transaction confirmation |
| Google Analytics | Website analytics | United States | IP address, usage data, device information, and browsing behavior for website analytics |
SUBPROCESSOR CHANGE NOTIFICATION
BBos will update this list and notify Client of changes in accordance with Section 5.3 of the DPA. An up-to-date list is always available at bbos.ai/subprocessors.
SUBPROCESSOR OBLIGATIONS
Each Subprocessor listed above is subject to a written agreement with BBos that includes data protection obligations substantially similar to those in the DPA, including:
- Confidentiality requirements
- Security measures appropriate to the nature of the Processing
- Restrictions on further subcontracting without authorization
- Assistance with Data Subject rights requests
- Personal Data Breach notification obligations
- Deletion or return of Personal Data upon termination
- Audit rights (where applicable)
SUBPROCESSOR LOCATIONS
Client acknowledges that Personal Data may be Processed by Subprocessors in the locations specified above. Where such Processing involves Restricted Transfers, the transfer mechanisms specified in Section 9 of the DPA apply.
CHANGES TO SUBPROCESSORS
BBos may:
- (a) Add new Subprocessors upon providing thirty (30) days' prior notice to Client
- (b) Change the services provided by existing Subprocessors upon providing thirty (30) days' prior notice if the change is material
- (c) Remove Subprocessors at any time without prior notice
Client's objection rights are described in Section 5.4 of the DPA.
For more information about our data processing practices, please review our Data Processing Addendum.