Bastivo Subprocessor List
Last Updated: September 18, 2026
1. About This List
This list identifies Bastivo's current Subprocessors — third parties that process Customer Personal Data on behalf of DICEUS Inc., operating the Bastivo product and brand ("Bastivo," "we," "us"), in connection with the Bastivo services, as described in the Bastivo Data Processing Addendum ("DPA"). This list does not include vendors Bastivo uses solely for its own purposes as a controller or business, as described in the Bastivo Privacy Policy, and does not include a technical integration, supported adapter, optional sign-in provider, or similar capability that is not actually used to process Customer Personal Data in Bastivo's production configuration.
2. Subprocessors
| Subprocessor | Service / Purpose | Categories of Data Processed | Processing Location / Region | Status / Notes |
|---|---|---|---|---|
| Microsoft Azure | Cloud infrastructure hosting the production application, database, and file storage | Account and application data processed through the Services | East US 2 | Active |
| Supabase | Backend platform: application/data services, and Auth (authentication/session) service | Account credentials, session data, application data | Application/data services: East US 2. Authentication service region: not yet publicly confirmed | Active |
| Azure Database for PostgreSQL Flexible Server (Microsoft Azure) | Primary production database | Application data stored in the Platform's database | East US 2 | Active |
| Microsoft Azure Blob Storage | Production file and object storage | Uploaded evidence documents, Provider logos and media, and other uploaded files | East US 2 | Active |
| Microsoft Defender for Storage | On-upload malware scanning of files stored in Azure Blob Storage | File content, scanned transiently before a file becomes usable or published | East US 2 | Active |
| SendGrid | Transactional and lifecycle email delivery | Recipient email address, message content, and delivery-status metadata | Not yet publicly confirmed | Active |
| HubSpot | CRM / system of engagement for Buyer and Provider commercial relationships | Name, business email address, company, job title, defined lifecycle and engagement-event context, marketing-consent status, and, where applicable, summary-level Assessment metadata. Does not include raw Assessment answers or Buyer Confidential/Internal information. | Not yet publicly confirmed | Active |
| Google Tag Manager | Tag-management delivery layer for approved analytics tags | Page and route context, and approved analytics events, where you have provided the applicable cookie consent | Google global infrastructure | Confirmed/Approved production configuration; deployment and runtime remain subject to verification at Production cutover |
| Google Analytics 4 | Web and product analytics | Client and session identifiers and defined conversion events, where you have provided the applicable cookie consent | Google global infrastructure | Confirmed/Approved production configuration; deployment and runtime remain subject to verification at Production cutover |
| PostHog | Product analytics, including masked session recording | Internal account identifiers, usage events, and masked session data, where you have provided the applicable cookie consent | U.S. Cloud | Confirmed/Approved production configuration; deployment and runtime remain subject to verification at Production cutover |
3. AI Service Providers
Bastivo's AI-assisted features, including the AI Assessment, are built on an architecture that supports more than one AI service provider. The existence of a supported technical integration with a given AI provider does not, by itself, mean that provider processes Customer Personal Data. As of the date above, Bastivo has not identified a specific AI service provider on this list as an active Subprocessor; this list will be updated to name the AI provider or providers actually enabled to process production data once that configuration is confirmed.
4. Vendors Not Included on This List
This list does not include a vendor that Bastivo uses only in a Test or Staging environment, only for Bastivo's own controller-side business purposes, or only as a supported-but-inactive technical integration. Google Search Console is not included because it is not used as a Subprocessor to process Customer Personal Data on Bastivo's behalf. LinkedIn OAuth remains an available production sign-in option, as described elsewhere in Bastivo's legal framework; it is not included on this list because its controller, processor, or Subprocessor classification has not yet been resolved, and it will be added if and when that classification is confirmed.
5. Changes to This List
Bastivo may update this list from time to time as its Subprocessors change, including when an additional AI service provider or other vendor becomes active in Bastivo's production configuration. A Customer with a Bastivo Data Processing Addendum in effect may direct questions about a change to this list to legal@bastivo.com.
6. Contact Us
Questions about this list may be directed to legal@bastivo.com. Our business address is 2810 N Church St, Ste 94987, Wilmington, Delaware 19802-4447, USA.