How to read this list
This page forms part of the DPA. A deployment uses the core providers and only those conditional providers its operator or Customer enables. The linked provider source is authoritative for that provider’s own downstream processors and may change independently.
Customer-connected systems and Customer-provided endpoints are recipients selected by the Customer, not subprocessors appointed by Boundlane AG. Enterprise customers receive a deployment-specific inventory in addition to this public capability list.
Current providers
Vercel
Vercel Inc.
- Purpose
- Hosting, application compute, workflows, queues, sandbox execution, AI Gateway and optional Blob storage.
- Processing location
- United States and the deployment regions selected for the Service.
- Transfer protection
- Swiss-recognised EU Standard Contractual Clauses and the safeguards in Vercel’s DPA, where required.
- Provider documentation
- Read the source
Neon
Neon, LLC
- Purpose
- Managed PostgreSQL storage, database branching, backup and recovery.
- Processing location
- The cloud region selected for the database; provider operations may also involve the United States.
- Transfer protection
- Swiss-recognised EU Standard Contractual Clauses and the safeguards in Neon’s DPA, where required.
- Provider documentation
- Read the source
Anthropic
Anthropic, PBC
- Purpose
- Model inference for the build agent and model-enabled runtime steps.
- Processing location
- United States.
- Transfer protection
- Vercel AI Gateway ZDR routing and applicable contractual transfer safeguards. Direct API use follows Anthropic’s commercial DPA and retention terms.
- Provider documentation
- Read the source
Used when an Anthropic model is selected. A Customer-provided model endpoint replaces this recipient for that workspace.
Stripe
The Stripe contracting entity shown at checkout
- Purpose
- Subscription checkout, invoices, payment status and billing portal.
- Processing location
- European Economic Area, United States and other locations described by Stripe.
- Transfer protection
- Stripe’s DPA and applicable adequacy decisions or Standard Contractual Clauses.
- Provider documentation
- Read the source
Used only where hosted billing is enabled. Card details are submitted directly to Stripe.
Resend
Plus Five Five, Inc.
- Purpose
- Sign-in codes, approval notifications and service email.
- Processing location
- United States.
- Transfer protection
- EU Standard Contractual Clauses with Swiss adaptations, as incorporated into Resend’s DPA.
- Provider documentation
- Read the source
Used only where email delivery is enabled.
Amazon Web Services or Google Cloud
The configured cloud provider entity
- Purpose
- Optional customer-credential key management and optional object storage.
- Processing location
- The region selected by the deployment operator.
- Transfer protection
- The provider DPA, selected regional controls and applicable Standard Contractual Clauses.
- Provider documentation
- Read the source
Used only when the deployment enables the corresponding KMS or storage driver.
Changes and objections
Workspace owners will receive notice as early as reasonably practicable. Where we receive sufficient advance notice, we will provide at least 30 days; an upstream provider’s shorter period or an urgent replacement needed to protect availability or security may require less, with notice without undue delay and before use where reasonably possible. A Customer may object during the available notice period on reasonable data-protection grounds as described in the DPA.
To subscribe a different contact or object to a change, email hello@boundlane.com.