Subprocessor list
Status: Current as of May 30, 2026 · Notification: 30 days in advance · Subscribe: privacy@burna.ai
Third-party service providers Burna engages to deliver and support the platform. Categorized for GDPR Article 28 and HIPAA business associate transparency. Customer-facing change notifications precede any new engagement.
Introduction
Burna AI uses third-party service providers (subprocessors) to deliver and support its platform. This page lists the categories of subprocessors Burna engages, the purpose of each engagement, and the geographic regions where data may be processed.
Burna AI maintains a Data Processing Agreement (DPA) with each subprocessor that handles personal data, and a Business Associate Agreement (BAA) with each subprocessor that may handle Protected Health Information (PHI) under HIPAA. Subprocessors are evaluated against Burna's security and compliance standards before onboarding and re-evaluated on a defined cadence.
This page is updated whenever a subprocessor is added, removed, or materially changed. Customers may subscribe to subprocessor change notifications by emailing privacy@burna.ai.
How to Read This List
For each subprocessor, the table below shows:
- Provider: the legal entity providing the service.
- Purpose: what Burna uses the service for.
- Data categories: what categories of data the subprocessor may process.
- Processing location: the geographic region(s) where data may be stored or processed.
- PHI access: whether the subprocessor may access Protected Health Information under HIPAA.
- Compliance: the subprocessor's relevant compliance certifications (SOC 2 Type II, ISO 27001, HIPAA BAA).
Subprocessor register
Cloud infrastructure and hosting
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Primary cloud infrastructure provider | Application hosting, database hosting, file storage | United States | Yes (BAA, region-restricted) | SOC 2 Type II, ISO 27001, HIPAA BAA |
| Regional cloud partners | Sovereign cloud hosting for regional deployments | Per regional deployment | Yes (BAA, region-restricted) | SOC 2 Type II or regional equivalent, HIPAA BAA where applicable |
Database and application infrastructure
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Real-time application database platform | Real-time application data and customer metadata | United States | Yes (BAA where applicable) | SOC 2 Type II, HIPAA BAA |
| Object storage provider | File and document storage | United States | Yes (BAA, encrypted at rest) | SOC 2 Type II, HIPAA BAA |
AI model providers (inference only)
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Enterprise large language model provider | Language model inference for the twelve-agent cascading constraint pipeline | United States and provider enterprise regions | No (PHI is de-identified before model invocation) | Enterprise compliance posture; SOC 2 and HIPAA BAA where applicable; customer data excluded from training |
Email, communication, CRM
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Transactional email provider | Transactional email (account, notifications, brief delivery) | United States | No | SOC 2, GDPR DPA |
| Newsletter platform | Newsletter subscription and delivery | United States | No | GDPR DPA |
| Calendly | Calendar booking for conversations | United States | No | SOC 2, GDPR DPA |
| Customer relationship management platform | Pipeline tracking, conversation history | United States | No | SOC 2, GDPR DPA |
Analytics and observability
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Privacy-preserving web analytics | Aggregated website traffic measurement | United States | No | GDPR DPA, no third-party data sharing |
| Error monitoring provider | Application error tracking | United States | No (PHI stripped from error contexts) | SOC 2, GDPR DPA |
| Log aggregation provider | Application and infrastructure log aggregation | United States | No (PHI never logged per pre-commit checks) | SOC 2, GDPR DPA |
Authentication and identity
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Authentication and identity provider | Customer authentication, session management | United States | No | SOC 2, ISO 27001 |
Payment processing
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Payment processor | Subscription and invoice processing | United States | No | PCI DSS Level 1, SOC 2 |
| WeFunder | Securities crowdfunding platform | US | No | SEC-registered funding portal |
Other services
| Provider | Purpose | Region | PHI access | Compliance |
|---|---|---|---|---|
| Document signing, legal, and operations tools | Contract execution, professional services, and internal operations | United States | No | SOC 2 or GDPR DPA, as applicable |
MODEL TRAINING NOTE Burna AI does not allow customer data to be used for model training or fine-tuning without explicit written consent from the customer for that specific use. Enterprise-grade contracts with LLM providers exclude customer data from training corpora by default. See the Responsible AI Statement for the full commitment.
Subprocessor onboarding process
Burna AI engages a new subprocessor only after:
- Security and compliance review of the subprocessor's posture (SOC 2 report, ISO 27001 certification, HIPAA BAA capability where applicable).
- Privacy review of the subprocessor's data handling and subprocessing chain.
- Execution of a Data Processing Agreement (DPA) with appropriate Standard Contractual Clauses for international transfers.
- Execution of a Business Associate Agreement (BAA) where the subprocessor may access PHI.
- Internal documentation of the data flow, retention, and incident response interface.
- Approval by Burna AI's security and engineering leadership.
Notification of changes
Burna AI notifies customers of new subprocessors that may process customer data at least 30 days before the subprocessor is engaged. Customers may object to a new subprocessor in writing within the notification window; Burna AI will work with the customer to find an alternative or, if no alternative is feasible, the customer may terminate the affected portion of the engagement with a pro-rata refund.
Subprocessor change notifications are sent to customer-designated security contacts and posted on this page.
To subscribe to subprocessor change notifications without an active customer relationship, email privacy@burna.ai with the subject line "Subprocessor Change Notifications."
Contact
For questions about Burna AI's subprocessors, processing locations, or data handling practices, reach the inboxes below. They also cover privacy review, security questionnaires, and subscription to subprocessor change notifications.
- Privacy questions: privacy@burna.ai
- Security questions: security@burna.ai
- General inquiries: hello@burna.ai
Questions about this document go to privacy@burna.ai.