Subprocessors
Our Authorized Data Subprocessors
Last updated: September 2025
This page lists BBos's authorized Subprocessors as referenced in our Data Processing Addendum (DPA). These third-party service providers help us deliver our services while maintaining the highest standards of data protection.
CURRENT SUBPROCESSORS
BBos currently uses the following Subprocessors to Process Personal Data:
| Subprocessor Name | Service Provided | Processing Location | Description |
|---|---|---|---|
| Google Cloud Platform (Firebase) | Cloud hosting, database, storage, authentication | United States, with global CDN | Primary infrastructure provider for hosting, data storage, and authentication services |
| OpenAI, LP | Artificial intelligence services | United States | AI-powered features including document analysis, content generation, and chatbots |
| Mistral AI | Artificial intelligence services | France, United States | Alternative AI provider for content analysis and generation |
| Twilio Inc. | Communications services | United States | Voice calling, video calling, SMS, and WhatsApp Business messaging |
| Intuit Inc. (QuickBooks) | Accounting integration | United States | QuickBooks Online integration for financial data synchronization |
| ElevenLabs | Voice synthesis | United States, United Kingdom | AI voice generation and text-to-speech services |
SUBPROCESSOR CHANGE NOTIFICATION
BBos will update this list and notify Client of changes in accordance with Section 5.3 of the DPA. An up-to-date list is always available at bbos.ai/subprocessors.
SUBPROCESSOR OBLIGATIONS
Each Subprocessor listed above is subject to a written agreement with BBos that includes data protection obligations substantially similar to those in the DPA, including:
- Confidentiality requirements
- Security measures appropriate to the nature of the Processing
- Restrictions on further subcontracting without authorization
- Assistance with Data Subject rights requests
- Personal Data Breach notification obligations
- Deletion or return of Personal Data upon termination
- Audit rights (where applicable)
SUBPROCESSOR LOCATIONS
Client acknowledges that Personal Data may be Processed by Subprocessors in the locations specified above. Where such Processing involves Restricted Transfers, the transfer mechanisms specified in Section 9 of the DPA apply.
CHANGES TO SUBPROCESSORS
BBos may:
- (a) Add new Subprocessors upon providing thirty (30) days' prior notice to Client
- (b) Change the services provided by existing Subprocessors upon providing thirty (30) days' prior notice if the change is material
- (c) Remove Subprocessors at any time without prior notice
Client's objection rights are described in Section 5.4 of the DPA.
For more information about our data processing practices, please review our Data Processing Addendum.