Subprocessors
Subprocessors
Last updated: 2026-06-06. These are the third-party providers ("subprocessors") we use to operate BuildingHQ. We update this list whenever it changes and we notify customers at least 30 days before a new subprocessor starts processing Personal Data.
Get notified of changes
To get email when this list changes, write to support@buildinghq.app with the subject "Subprocessor notifications" and the address you'd like notices sent to.
Current list
| Provider | Role | Purpose & data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure | Hosting, storage, database, networking, and email delivery (inbound and outbound). Stores Customer Data at rest. | United States |
| Google LLC (Google Cloud) | LLM + geocoding APIs | LLM API used by the smart-import feature to map spreadsheet columns to fields, and address-autocomplete for building/area entry. Receives PII-scrubbed prompts or search terms only, under commercial terms that prohibit training on submitted data. | United States |
| Auth0 by Okta | Authentication | Identity provider for sign-in, social SSO, and enterprise SAML/OIDC. Receives email addresses and identifier metadata. | United States / Ireland |
| Anthropic, PBC | LLM provider | LLM API used by the smart-import feature to map spreadsheet columns to fields. Receives PII-scrubbed prompts under enterprise API terms that prohibit training on submitted data. | United States |
| Stripe, Inc. | Payment processing | Subscription billing for paid tiers. PCI-Level-1 processor; we don't receive full card numbers. (Active once paid tiers launch.) | United States |
| GitHub, Inc. | Code hosting + release distribution | Source control and the release-distribution channel for desktop binaries. Doesn't process Customer Data. | United States |
How this fits with our DPA
Each subprocessor is bound by a written agreement with data-protection terms at least as protective as our Data Processing Addendum. We remain liable to customers for the acts and omissions of subprocessors processing Personal Data on our behalf.
Where Personal Data is transferred internationally, the transfer is covered by Standard Contractual Clauses or another lawful mechanism as described in our DPA.
Sub-subprocessors
Some of the providers above use their own subprocessors (typically cloud infrastructure underneath them). Those are governed by the provider's own DPA, linked next to each entry above. We monitor material changes and reflect them here.