Sub-processor

What it is#

A sub-processor is any third-party vendor SendBriefs engages that handles personal data in the course of operating the product. Under GDPR Art. 28, the agency (the "controller") has the right to know who these vendors are, what they do with the data, where they're located, and to object to changes.

Common SendBriefs sub-processors include hosting (Vercel), database (Supabase), transactional email (SendGrid), billing (Stripe), and error monitoring (Sentry). The full current list is at /legal/subprocessors.

Why this matters#

Three reasons agencies care about who SendBriefs's sub-processors are:

1. Their own clients ask. Agencies serving regulated clients (legal, healthcare, finance) get security questionnaires asking exactly this question. The agency needs to be able to answer accurately.
2. GDPR / data-residency compliance. EU agencies may have client contracts that restrict where personal data can be processed. Knowing every sub-processor's location is necessary for that compliance.
3. Trust + transparency. Pre-launch SaaS companies that bury their sub-processor list raise legitimate concerns. Open transparency is the lower-friction posture.

The 30-day advance-notice commitment#

SendBriefs commits to 30 days advance notice before any new sub-processor begins processing customer data. The notice goes to the billing contact on the workspace and is reflected on the Subprocessors page.

If you object to a new sub-processor within the 30-day window, you can cancel the subscription with a prorated refund of unused fees. That's the GDPR Art. 28(2) right made operational.

Sub-processor vs. integration#

These are different:

• Sub-processor — SendBriefs decides to use them; bound by a DPA SendBriefs signs
• Integration — you decide to connect them to your workspace; bound by your agreement with them, not ours

See Subprocessors §2.5 for the integration carve-out.