# BeyondCore — Sub-processors

**Last updated: 2026-07-24**

BeyondCore acts as a **data processor** on behalf of its customers (the **controllers**). This page
lists every third party that may process customer personal data on our behalf, why, and where. We
keep it current; material changes are communicated to customers with a right to object per the DPA.

BeyondCore is operated by **BeyondCore (Org.nr 559155-2129)**, Sweden.

## Hosting region

The platform is **hosted in the EU — Frankfurt, Germany** (Fly.io region `fra`), including the
application and its database. Customer data is processed and stored in the EU by default.

## Sub-processor list

| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| **Fly.io** (Fly.io, Inc.) | Application hosting, compute, and managed PostgreSQL database | Account data; assessment results and findings (scores, counts, per-finding evidence snippets, record identifiers). **Never** the customer's raw master-data extract — it is processed in memory and discarded. | EU — Frankfurt (`fra`) |
| **Anthropic** (Anthropic, PBC) | AI Engine — semantic analysis (duplicate / misclassification / naming / junk) | Only a **positive allowlist** of non-identifying fields per domain (e.g. legal name, city, country, status, material description). Deliberately **excludes** VAT/tax IDs, email, phone, bank/IBAN, credit limits, payment terms. Configured for **no training and no retention** (Zero Data Retention). | US |
| **Transactional email (SMTP provider)** | Delivery of contact-form messages to BeyondCore | Sender email address and message body submitted via the public contact form only. Not used for customer master data. | Per provider (configurable; EU provider available) |

## Notes that matter

- **The public Sandbox never uses a sub-processor for your own data.** When a prospect runs the
  no-login sandbox on their own CSV, only the deterministic Rule Engine runs — no data is sent to
  the AI provider, and nothing is stored.
- **The AI Engine is optional and provider-independent.** Anthropic is the default AI sub-processor;
  it can be swapped for another provider (including an EU-hosted one) via configuration, or the AI
  Engine can be disabled entirely (rule-only).
- **Full EU residency & no external AI sub-processor** is available on **Customer-Managed Cloud** and
  **on-premise** deployments, where the data & knowledge plane runs inside the customer's own trust
  boundary and the customer supplies their own AI provider.
- **International transfers.** Where a sub-processor processes data outside the EEA (e.g. the default
  AI provider), transfers are governed by the EU Standard Contractual Clauses, and only the
  allowlisted, non-identifying fields described above are transferred.

For the data-processing terms themselves, see the **[DPA template](/legal/dpa)**. For what is and
isn't retained, see **`docs/knowledge-retention-spec.md`**.