BeyondCore — Sub-processors
Last updated: 2026-07-24
BeyondCore acts as a data processor on behalf of its customers (the controllers). This page lists every third party that may process customer personal data on our behalf, why, and where. We keep it current; material changes are communicated to customers with a right to object per the DPA.
BeyondCore is operated by BeyondCore (Org.nr 559155-2129), Sweden.
Hosting region
The platform is hosted in the EU — Frankfurt, Germany (Fly.io region fra), including the application and its database. Customer data is processed and stored in the EU by default.
Sub-processor list
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Fly.io (Fly.io, Inc.) | Application hosting, compute, and managed PostgreSQL database | Account data; assessment results and findings (scores, counts, per-finding evidence snippets, record identifiers). Never the customer's raw master-data extract — it is processed in memory and discarded. | EU — Frankfurt (fra) |
| Anthropic (Anthropic, PBC) | AI Engine — semantic analysis (duplicate / misclassification / naming / junk) | Only a positive allowlist of non-identifying fields per domain (e.g. legal name, city, country, status, material description). Deliberately excludes VAT/tax IDs, email, phone, bank/IBAN, credit limits, payment terms. Configured for no training and no retention (Zero Data Retention). | US |
| Resend (Resend, Inc.) | Transactional email — address confirmation, password reset, team invitations, and contact-form messages | Recipient email address and the message body (links and names). Never customer master data. | EU region (Ireland) |
Notes that matter
- The public Sandbox never uses a sub-processor for your own data. When a prospect runs the
no-login sandbox on their own CSV, only the deterministic Rule Engine runs — no data is sent to the AI provider, and nothing is stored.
- The AI Engine is optional and provider-independent. Anthropic is the default AI sub-processor;
it can be swapped for another provider (including an EU-hosted one) via configuration, or the AI Engine can be disabled entirely (rule-only).
- Full EU residency & no external AI sub-processor is available on Customer-Managed Cloud and
on-premise deployments, where the data & knowledge plane runs inside the customer's own trust boundary and the customer supplies their own AI provider.
- International transfers. Where a sub-processor processes data outside the EEA (e.g. the default
AI provider), transfers are governed by the EU Standard Contractual Clauses, and only the allowlisted, non-identifying fields described above are transferred.
For the data-processing terms themselves, see the DPA template. For what is and isn't retained, see docs/knowledge-retention-spec.md.