Subprocessor List

This Subprocessor List names the third parties that By5 engages to process Customer Personal Data on the Customer's behalf, as described in the Data Processing Addendum. It also lists services that are not subprocessors, and explains why.

In this list, "By5" means By5 Ltd. "Customer Personal Data" has the meaning given in the Data Processing Addendum.

This list should be read together with the By5 Privacy Policy and Data Processing Addendum.

How this list works

The Data Processing Addendum gives By5 general written authorisation to use the subprocessors named here. Before a new subprocessor begins processing Customer Personal Data, By5 will update this list and notify the Customer's account administrator at least 14 days in advance, and the Customer may object as described in the Data Processing Addendum.

Some subprocessors are used only when the Customer uses the feature named against them. Locations are where each provider processes Customer Personal Data for By5. Providers may also give support or security access from other countries under their own terms. Where a provider processes data outside the United Kingdom, the Data Processing Addendum sets out the transfer safeguards that apply.

Subprocessors

• Railway (Railway Corporation): hosts the By5 application servers, database, background jobs and voice gateway, which store and process all Customer Personal Data held in the platform. Location: the Netherlands (European Economic Area) for the production service. Railway is a United States company. Railway data processing terms.
• Vercel (Vercel Inc.): hosts the By5 website and web application and passes requests between the Customer's browser and the By5 application servers, including the Customer Personal Data in those requests. Location: United States and Vercel's global network. Vercel data processing terms.
• Auth0 (Okta, Inc.): signs in the Customer's authorised users and manages their accounts and invitations, using their names, email addresses and sign-in records. Location: United Kingdom. Okta data processing terms.
• Twilio (Twilio Inc.): sends and receives SMS and, where enabled, WhatsApp messages sent through Twilio, and handles phone calls, call menus and voicemail recordings for the Customer's connected numbers. It processes phone numbers, message content, call audio and recordings. Location: United States. Twilio data protection terms.
• Mailgun (Sinch): sends email from the platform and receives email sent to the Customer's By5 capture addresses. It processes email addresses, message content and attachments. Location: United States. Mailgun data processing terms.
• OpenAI (OpenAI): provides the AI models behind enquiry sorting and summaries, reply drafts, quote preparation, voice transcription and voice assistants. It processes the enquiry, message, quote and job content, photos, call audio and transcripts that each feature sends to it. Location: United States. OpenAI data processing terms.
• Anthropic (Anthropic): provides backup AI models for enquiry sorting and quote preparation when the primary AI provider is unavailable. It processes the same kind of content as the primary AI provider for those features. Location: United States. Anthropic data processing terms.
• ElevenLabs (ElevenLabs): provides the voice agent used for the spoken business setup interview and, where selected, for voice features in quote preparation. It processes the voice audio and transcripts of the Customer's authorised users. Location: United States, ElevenLabs' default location. ElevenLabs data processing terms.
• Sentry (Functional Software, Inc.): error monitoring for the By5 application servers. Error reports can incidentally contain Customer Personal Data from the request or record being processed when the error occurred. Location: Germany (European Economic Area). Sentry data processing terms.
• Ideal Postcodes and postcodes.io (IDDQD Limited): address lookup and postcode locations. They receive postcodes, without names or other customer details. Location: not published by the provider; IDDQD Limited is a United Kingdom company. Ideal Postcodes data processing terms.

Services that are not subprocessors

These services are not By5's subprocessors for Customer Personal Data, for the reason given against each.

• Services the Customer connects to its own account. When the Customer connects its own account with a third party, that third party processes data under the Customer's own agreement with it, and By5 sends data to it only as the Customer's configuration directs. This includes the Customer's WhatsApp Business account, Facebook pages and Instagram account with Meta; its Google or Microsoft mailbox; its own email server; its Xero or QuickBooks accounting account; its TrueLayer open banking connection; its LinkedIn or TikTok accounts; and an AI assistant, such as ChatGPT or Claude, that the Customer connects to its By5 account.
• Stripe. Stripe processes By5's own subscription billing for the Customer's account, where By5 is the controller, as described in the Privacy Policy. Where the Customer takes deposits or invoice payments from its own customers, Stripe processes those payments through the Customer's own connected Stripe account, under the Customer's agreement with Stripe.
• Google Maps. When the Customer's users view the working-areas map, the map is loaded from Google in their browser. Customer records are not sent to Google; customer locations are drawn on the map in the browser.
• Services that receive no Customer Personal Data. By5 uses GitHub for its own engineering work, and a weather service that receives only approximate map coordinates when that feature is enabled.

Changes

By5 may add, replace or remove subprocessors to support service delivery, security, reliability, compliance or operational requirements. Additions and replacements follow the notice and objection process in the Data Processing Addendum, and this list is updated before a new subprocessor begins processing Customer Personal Data.