Sub-processors
Last updated: 24 September 2026
Branch Pilot relies on the following third parties to provide the service. Each one processes data on behalf of INNOFI under a data processing agreement, and, where data leaves the European Union, under the European Commission’s standard contractual clauses (SCC).
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. (on Amazon Web Services) | Database, authentication, API functions, logs | Account data, decisions, pseudonymized runs | European Union (Paris, eu-west-3) |
| Netlify, Inc. | Hosting and content delivery of the website and application front end | IP addresses and request logs | United States and global CDN — SCC |
| TypeSafe AI | Decision inference (Jev engine) | Pseudonymized payloads only; no account data | United States — DPA and SCC |
| Mistral AI | Fallback inference when the primary engine is unavailable | Pseudonymized payloads only; no account data | European Union (France) |
| Stripe, Inc. | Payments, invoices, VAT | Billing identity, payment method (never stored by Branch Pilot) | United States and European Union — SCC |
| Plausible Insights OÜ | Cookie-less, aggregated website analytics | No personal data, no cookies | European Union (Estonia) |
| Google LLC (Google Workspace) | Email correspondence with customers | Emails you send us | European Union and United States — SCC |
| [Transactional email provider — to be selected] | Sign-in links, quota alerts, review notifications | Email address, message content | [to be completed] |
We notify account owners by email at least 30 days before adding or replacing a sub-processor. Objections can be sent to hello@branchpilot.ai.