Subprocessor List
The providers and processing boundaries to assess for a Bulk deployment, including hosting, email, AI, diagnostics and billing.
Effective
How to read this list
ManagementSupport LLC, trading as Bulk, uses services appropriate to each deployment. This list distinguishes providers from software Bulk operates itself and from systems selected by a customer. A provider’s presence here does not mean every customer uses it, or that every service receives all workspace data.
This list is a deployment-selection register, not a representation that every provider agreement, contracting affiliate or location has been verified. Before adopting the DPA, the applicable order must identify the actual recipients, legal contracting entities, locations and safeguards. An uncertain location is not permission for unrestricted processing.
Infrastructure and delivery
| Provider | Function and information | Applicability and location boundary |
|---|---|---|
| OVHcloud | Compute and storage hosting workspace data, files and application services | Hosting provider represented in Bulk infrastructure and customer documentation. Country and contracting affiliate depend on the selected deployment and must be identified in the order |
| Hetzner | Hosting for deployments or supporting services where selected | Referenced in hosting material; inclusion for a specific customer requires confirmation of the deployed service, country and contracting entity |
| Cloudflare | Network edge, DNS/security services and, where configured, R2 backup/object storage | Network metadata and traffic handled by the edge; backup exports and files where R2 is used. Edge processing is distinct from storage jurisdiction. Neither backup region nor client-side encryption is established merely by selecting R2 |
Communications, AI and commercial services
| Provider | Function and information | Applicability and location boundary |
|---|---|---|
| Resend | Transactional email and template delivery | Recipient addresses, message content, metadata and attachments where sent. Do not treat this as metadata-only processing. Applicable contract, processing locations and retention require verification |
| Google Cloud / Vertex AI | AI inference for enabled document extraction and assistant features | Submitted prompts, documents and task-specific record context. Current application code requires a global Vertex endpoint; this is not a same-country processing guarantee. Contracting entity, model-specific terms and retention controls must be confirmed |
| OpenRouter and selected downstream inference providers | Optional fallback for selected Vertex request failures | Enabled only when configured; the request content is routed through OpenRouter to the selected model/provider. Downstream recipients, routing, retention and contractual protection must be identified before authorising this path |
| Stripe | Subscription/payment services where configured | Billing contacts, subscription and payment information; not a general destination for manufacturing records. Its controller or processor role depends on the service and purpose, and must be assessed under the applicable terms |
Self-hosted software and support systems
Convex, Umami and OpenReplay are software names, not automatically separate companies receiving customer data. When Bulk self-hosts them, the relevant recipients are Bulk and the infrastructure, storage and network providers used to run them. Hosting destinations and access still need to be disclosed and assessed.
Ahrefs Web Analytics and Ahrefs Bot Analytics, operated by Ahrefs Pte. Ltd., cover the marketing website only (trybulk.app and www.trybulk.app). Web Analytics collects aggregate traffic statistics in the browser. Bot Analytics runs as a Cloudflare Worker on those two hostnames and sends request metadata, including IP address and user agent, to Ahrefs to classify bot traffic. Neither is loaded in or routed to customer workspaces, and neither receives workspace data. Umami website analytics and replay are separate from customer-product OpenReplay. Product replay can contain identifiable users, displayed page content and diagnostic information. Logs and telemetry may be forwarded to an observability platform such as Axiom where configured. The receiving entity, data fields, location and retention must be confirmed for each such external service before representing this register as complete for a deployment.
Secrets-management services, including Infisical where used, may hold privileged credentials. The claim that they hold “no customer data” must not be used to avoid evaluating the access those credentials permit. Provider roles are determined by the actual processing, not by a narrow label.
Customer-selected integrations
Customer-controlled email, ERP, messaging, storage and AI connections may transmit information to additional recipients. A customer-selected provider is generally the customer’s responsibility under its own contract, but the actual arrangement determines the role. Azure Service Bus, for example, is not exempt from assessment simply because it transports messages rather than acting as the main database.
WorkOS appears as a future identity provider in older documentation; that is not evidence it is currently active. New providers and new downstream AI recipients require assessment and authorisation before use.
Changes and objections
For customers adopting the DPA, Bulk gives the nominated contact at least 30 days’ prior written notice of a proposed relevant addition or replacement, including its purpose and locations. Customers may raise reasonable data-protection objections during that period. The DPA describes resolution, alternatives and termination of affected services if no resolution is available. A website update alone does not replace the contractual notice.
Send provider or change-notice enquiries to support@trybulk.app. The contact and delivery process for contractual notices should be recorded in the order.
Updates
22 September 2026: this list distinguishes hosting, network delivery, email content, global AI, optional fallback, replay and customer integrations. An update entry does not replace a required customer notification or authorise new processing.