Brainstorm Force US LLC (“BSF”) uses the third-party sub-processors listed below to provide its services. This page covers all products operated by BSF: SureContact, Sigmize, OttoKit, ZipWP, and SureFeedback. SureCart is operated by SureCart Inc. under a separate Data Processing Agreement and is not covered on this page.
Sub-processors are listed by product and organised by function. Core Infrastructure sub-processors are always engaged as part of the service. Customer-Configured sub-processors are only engaged when the Customer enables or connects them. BSF will update this page and provide notice of material changes in accordance with Section 5.2 of the Data Processing Agreement.
SureContact
CRM and email marketing platform · Processor: Brainstorm Force US LLC · Application servers: United States (St. Louis) · Email relay infrastructure: European Union (Germany / Finland)
Core Infrastructure
Sub-processor
Service
Location
Velia.net, LLC
Dedicated bare-metal hosting of application servers, PostgreSQL database, Redis cache and queue workers, WebSocket server, and all Customer data at rest and in memory
USA (St. Louis, MO)
Hetzner Online GmbH
Dedicated server hosting for the SureContact self-hosted Postal email relay (smtp.surecontact.co), used for campaign and transactional email delivery on SureContact’s own infrastructure
EU (Germany and/or Finland)
BunnyWay d.o.o. (Bunny.net)
Global CDN and TLS termination for customer email-tracking domains (open-pixel and click-redirect URLs); processes email-recipient IP address and user-agent on each open or click event
Global (headquartered in Slovenia, EU)
Operational Services
Sub-processor
Service
Location
Salesforce, Inc. (Slack)
Internal engineering error-alert webhook; incidental recipient identifiers may appear in exception context delivered to BSF’s internal engineering channel
USA
Customer-Configured Email Providers
The following providers are engaged only when a Customer explicitly selects and configures that provider within their SureContact account. If no external provider is configured, SureContact uses its own self-hosted Postal relay (see Core Infrastructure above).
Sub-processor
Service
Location
Sinch AB (Mailgun)
Email delivery — HTTP API; US or EU region per Customer choice
USA or EU (Customer choice)
Twilio Inc. (SendGrid)
Email delivery — HTTP API
USA
ActiveCampaign, LLC (Postmark)
Email delivery — HTTP API
USA
Sendinblue SAS (Brevo)
Email delivery — HTTP API
France (EU)
Resend, Inc.
Email delivery — HTTP API
USA
SocketLabs, Inc.
Email delivery — HTTP API
USA
Emailit
Email delivery — HTTP API
USA
toSend
Email delivery — HTTP API
USA
Amazon Web Services, Inc. (SES)
Email delivery — HTTP API; region configured by Customer
USA (region per Customer)
Sinch AB (Mailjet)
Email delivery — SMTP
France (EU)
Proven, Inc. (SMTP2GO)
Email delivery — SMTP
United States / New Zealand
MailerLite UAB (MailerSend)
Email delivery — SMTP
Lithuania (EU)
Google LLC / Google Ireland Ltd. (Gmail & Google Workspace)
Email delivery — OAuth 2.0 integration for Google Workspace; SMTP for consumer Gmail
USA / Ireland (EU)
Microsoft Corporation (Microsoft 365 / Outlook)
Email delivery — OAuth 2.0 via Microsoft Graph SMTP
USA / EU (per Customer’s Microsoft tenant region)
Customer-Configured Integrations
The following integrations are only engaged at the Customer’s explicit instruction. SureContact acts solely as a technical conduit; the third-party operator is selected and controlled by the Customer.
Sub-processor
Service
Location
Custom SMTP Endpoint (Customer-supplied)
Any third-party SMTP server or relay configured by the Customer by supplying SMTP credentials. Recipient email address and email content are transmitted to the Customer-chosen endpoint.
Customer-controlled
Data Migration Sources (Mailchimp, Brevo, Kit / ConvertKit, ActiveCampaign, MailerLite)
Customer imports contact and subscriber data into SureContact from an external platform by supplying API credentials issued to the Customer’s own account at that source. SureContact reads and stores the Customer’s data solely at the Customer’s instruction.
Determined by Customer’s source provider
Customer-Configured Outbound Webhook Endpoints
Automation actions that POST contact, campaign, or event data to third-party URLs configured by the Customer, including the Send Webhook automation action and the WordPress Connection sync.
Customer-controlled
Sigmize
A/B testing and visitor analytics platform · Processor: Brainstorm Force US LLC · Servers: United States (St. Louis)
Core Infrastructure
Sub-processor
Service
Location
Velia.net, LLC
Dedicated bare-metal hosting of the Sigmize application stack: web server, Laravel application, PostgreSQL primary and session-replay databases, Redis, queue workers, WebSocket server, screenshot workers, and all Customer and end-user data at rest and in memory
USA (St. Louis, MO)
Cloudflare, Inc.
DNS, TLS termination, CDN, WAF, and DDoS protection for Sigmize application domains. All end-user browser traffic to tracking, assignment, heatmap, and session-replay endpoints, and all downloads of the JavaScript SDK, transit Cloudflare’s edge.
Global Anycast (headquartered in USA)
Application Services
Sub-processor
Service
Location
Laravel LLC (Nightwatch)
Application performance monitoring and error telemetry; sampled request traces, database-query profiles, and exception captures. Authenticated Customer user IDs and — incidentally — end-user visitor IDs and IP addresses present in sampled request context.
USA
Amazon Web Services, Inc. (SES)
Outbound transactional email delivery — workspace invitations sent to Customer colleagues, account verification, password reset, and billing notifications
USA (us-east-2)
Customer-Configured Integrations
The following integrations are only engaged at the Customer’s explicit instruction. Sigmize acts solely as a technical conduit; the third-party operator is selected and controlled by the Customer.
Sub-processor
Service
Location
Shopify Inc. (Customer-owned Shopify stores)
Customer connects their own Shopify store to Sigmize via OAuth to run experiments against the store and read order and conversion data. The Shopify store is operated by the Customer under the Customer’s own contract with Shopify; Sigmize reads data solely at the Customer’s instruction.
USA / Canada (per Shopify)
Customer-Configured Outbound Endpoints
Experiment, assignment, conversion, and event payloads delivered to third-party URLs configured by the Customer, including the Sigmize WordPress Connection sync and custom outbound webhook endpoints.
Customer-controlled
OttoKit
No-code workflow automation platform · Processor: Brainstorm Force US LLC · Servers: United States (Chicago)
Core Infrastructure
Sub-processor
Service
Location
PhoenixNAP, Inc.
Bare-metal dedicated server hosting — all OttoKit application components (MySQL database, Redis cache, Laravel application, WebSocket server, queue workers) run on PhoenixNAP servers. All Customer and end-user data at rest and in memory.
USA (Chicago, IL)
Cloudflare, Inc.
CDN, TLS termination, DNS, and DDoS protection. All inbound webhook payloads and API requests — including workflow automation data that may contain end-user personal data — are proxied through Cloudflare.
Global Anycast (headquartered in USA)
Amazon Web Services, Inc. (S3)
Object storage for workflow-related files, attachments, and exported data processed through OttoKit automation workflows
Browser and mobile push notifications delivered to end users via OttoKit workflow automation actions; processes FCM device token, notification title, message body, and link URL
USA
Meta Platforms, Inc. (WhatsApp Business API)
WhatsApp messages delivered to end users via OttoKit workflow automation actions; processes WhatsApp mobile number and message content
USA
AI Processing
The following providers process workflow execution context that may include end-user identifiers and attributes sourced from connected integrations, depending on how the Customer configures their automations.
Sub-processor
Service
Location
OpenAI, LLC
AI-powered workflow features: Otto assistant (chat completions), workflow builder, and semantic search embeddings
USA
Anthropic, PBC
AI language model services — Claude models used in workflow automation features and AI-powered integrations
USA
Google LLC (Gemini AI)
AI language model services — Google Gemini models used in workflow automation features and AI-powered integrations
USA
Microsoft Corporation (Azure AI)
AI language model services — Azure-hosted models used in workflow automation features and AI-powered integrations
France (EU) for EU customers; USA
Groq, Inc.
AI inference services — Groq-hosted models used in workflow automation features and AI-powered integrations
USA
Billing
Sub-processor
Service
Location
SureCart, Inc.
Subscription billing and plan management for OttoKit customers. Listed separately as SureCart Inc. is not wholly owned by Brainstorm Force US LLC.
USA (Fly.io)
Error Monitoring
Sub-processor
Service
Location
Functional Software, Inc. (Sentry)
Error tracking and performance monitoring; stack traces and request context may incidentally contain end-user data routed through OttoKit workflows
USA
Note: OttoKit account authentication (Google OAuth, Facebook OAuth), product-usage analytics on OttoKit Customers (PostHog), and session recording of the OttoKit user interface (Microsoft Clarity) are addressed in the Brainstorm Force Privacy Policy — they process Customer account and product-usage data for which BSF acts as controller, and are not sub-processors of the Controller Data described in the DPA.
Code Execution
Sub-processor
Service
Location
Amazon Web Services, Inc. (Lambda)
Serverless compute for executing customer-authored JavaScript code within OttoKit workflow automation actions. Code runs in isolated Lambda functions; workflow payload data — which may include end-user personal data from connected apps — is present in the execution context.
USA
ZipWP
AI-powered WordPress website builder · Processor: Brainstorm Force US LLC · ZipWP application servers: United States
Core Infrastructure
Sub-processor
Service
Location
Cloudflare, Inc.
CDN, reverse proxy, SSL/TLS termination, DNS, and DDoS protection for customer WordPress sites hosted on ZipWP-managed domains. DNS A records are created with proxy mode enabled, meaning all end-user HTTP/HTTPS traffic to customer sites is routed through Cloudflare’s edge network.
Global Anycast (headquartered in USA)
BunnyWay d.o.o. (Bunny.net)
CDN pull zones for customer WordPress sites, serving cached static assets (images, CSS, JavaScript) globally. Authoritative DNS zone management for customer site domains on zipwp.app, zipwpcloud.com, and zipwp.dev root domains.
Global (headquartered in Slovenia, EU)
Amazon Web Services, Inc. (S3)
Encrypted cloud backup storage for customer WordPress sites. ZipWP performs automated incremental backups of full WordPress installations — including database exports and all wp-content files — and stores them in S3. Backups may contain end-user personal data held in the customer’s WordPress site (contact form submissions, user accounts, WooCommerce order data, etc.).
USA (us-west-2, Oregon)
Acronis International GmbH
Full server-level backup solution for all ZipWP-managed servers. Acronis performs complete server backups of machines hosting customer WordPress sites, including operating system, application files, and all databases. Backup images contain all end-user personal data stored on the server.
Switzerland (headquartered); global data centre network
Customer Site Hosting Providers
When using ZipWP’s cloud hosting or sandbox features, customer WordPress sites are provisioned on one of the following infrastructure providers. The provider engaged depends on the Customer’s chosen plan and configuration. Customer WordPress sites — including all end-user data the Customer’s site collects — run on servers managed by the applicable provider.
Sub-processor
Service
Location
The Constant Company, LLC (Vultr)
Cloud virtual machine infrastructure for customer WordPress sites
USA (Los Angeles, CA)
Hetzner Online GmbH
Cloud and dedicated bare-metal server infrastructure for customer WordPress sites (Cloud Sites tier and sandbox environments)
USA (Ashburn, VA)
InterServer, Inc.
Dedicated server and cloud infrastructure for customer WordPress sites (Cloud Sites and sandbox environments)
USA (Secaucus, NJ)
Server Management
Sub-processor
Service
Location
RunCloud Sdn. Bhd.
Server management panel used to provision web applications, manage databases, deploy WordPress installations, configure web server and PHP, and install SSL certificates. The RunCloud agent operates with root-level access on servers that store Customer WordPress site data and all end-user personal data within those sites.
Malaysia (headquartered); manages servers globally
SureFeedback
Visual feedback and website annotation platform · Processor: Brainstorm Force US LLC · Servers: Finland (EU, Helsinki)
Core Infrastructure
Sub-processor
Service
Location
Hetzner Online GmbH
Dedicated bare-metal hosting of the SureFeedback application stack: web server, Laravel application, PostgreSQL primary database, Redis, queue workers, and real-time broadcasting. All Customer and end-user data at rest and in memory, including reviewer names, email addresses, feedback content, screenshots, mockups, and attachments.
Finland (Helsinki, EU)
Cloudflare, Inc. (incl. R2)
DNS, TLS termination, CDN, WAF, and DDoS protection for SureFeedback application domains. Cloudflare R2 provides primary object storage and CDN delivery for user-uploaded mockups, screenshots, PDF exports, Figma design exports, and attachments.
Global Anycast (headquartered in USA)
Application Services
Sub-processor
Service
Location
Amazon Web Services, Inc. (SES)
Outbound email delivery — workspace and site invitations sent to Customer-invited reviewers, comment-notification emails, digest emails, and password-reset emails
USA (us-east-1 for campaign email; us-west-2 for transactional email)
Amazon Web Services, Inc. (S3)
Redundant object storage for user-uploaded assets (screenshots, mockup images, PDF exports, and attachments uploaded by reviewers); stored separately from the primary Cloudflare R2 storage
Europe (eu-north-1, Stockholm)
Laravel LLC (Nightwatch)
Application performance monitoring and error telemetry; sampled request traces, database-query profiles, and exception captures. Authenticated Customer user IDs and — incidentally — end-user IP addresses and identifiers present in sampled request context.
USA
Google LLC (OAuth / Sign in with Google)
End-user authentication — Customer-invited reviewers and Customer users may sign in to SureFeedback using their Google account; processes OAuth tokens, email address, name, and profile picture URL
USA
Customer-Configured Integrations
The following integrations are only engaged at the Customer’s explicit instruction. SureFeedback acts solely as a technical conduit; the third-party operator is selected and controlled by the Customer.
Sub-processor
Service
Location
Figma, Inc. (Customer-owned Figma accounts)
Customer connects their own Figma account via OAuth to import design files and mockup images for review. The Figma account and design files are controlled by the Customer under the Customer’s own contract with Figma; SureFeedback reads data solely at the Customer’s instruction. No end-user reviewer personal data is transmitted to Figma by SureFeedback.
USA
Customer-Configured Outbound Endpoints
Webhook deliveries that send comment, feedback, status-change, and assignment payloads to third-party URLs configured by the Customer, including the SureFeedback WordPress plugin sync and custom outbound webhook endpoints.
Customer-controlled
Transfer safeguards: Where a sub-processor is located outside the European Economic Area (including all sub-processors based in the United States), BSF ensures that appropriate transfer safeguards — such as the EU Standard Contractual Clauses (Module 2, Decision (EU) 2021/914) — are in place before transferring Controller Data.
Changes to this list: BSF may update this list from time to time. Customers will receive notice of material changes in accordance with the Data Processing Agreement. You may also check this page regularly for the latest version.
