Subprocessor List
Version 1.0 · Effective 4 September 2026
This page lists the third parties that process personal data on Bluto's behalf in connection with the Bluto platform. A sub-processor is a third party engaged by us to help deliver the Service, processing personal data on our instructions and under a data processing agreement. It is published under clause 4.2 of our Data Processing Agreement at bluto.ai/legal/dpa and Article 28 of the UK General Data Protection Regulation.
01About This Page
What this list covers, how we notify you of changes, and how to object.
1.1 This page lists the sub-processors engaged by Bluto as at the effective date of this version. Where we add, replace or remove a sub-processor, we update this page and record the change in the change log at the foot of the page.
1.2 For each sub-processor we state the contracting entity, the service it provides, the categories of personal data it processes, where processing takes place, and the mechanism relied upon where personal data is transferred outside the United Kingdom.
1.3 Three positions appear in the Transfer Mechanism column below. United Kingdom means processing takes place here and no transfer occurs. Adequacy means the United Kingdom has determined that the country concerned provides an equivalent standard of protection, so no additional mechanism is required -- this applies to Germany and Ireland. SCCs means Standard Contractual Clauses, terms approved by the Information Commissioner's Office and incorporating the UK Addendum, which bind the recipient to United Kingdom standards of protection.
1.4 Bluto's AI features are built on our own architecture. The agentic workflows, orchestration logic, prompt construction and output processing are ours and run on our infrastructure. The providers listed under AI and Document Processing supply specific components within that architecture and receive only the inputs necessary to perform their function.
1.5 We will notify Subscribers of any intended addition or replacement of a sub-processor at least 14 days before the change takes effect, by updating this page and, where the Subscriber has subscribed to update notifications, by email. To subscribe, email [email protected] with the subject line "Sub-processor update notifications".
1.6 Subscribers may object to a new sub-processor on reasonable and documented data protection grounds in accordance with clause 4.4 of the Data Processing Agreement, by emailing [email protected] within 14 days of notice.
1.7 For any question about this list or about how a sub-processor handles personal data, contact [email protected].
02Infrastructure and Hosting
The infrastructure on which the Service runs.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc.* | Cloud infrastructure, compute, storage and database services on which the Bluto platform runs | All personal data and Customer Content processed through the Service, including account data, usage data, documents and AI interaction metadata | United Kingdom (London) | United Kingdom; SCCs for support access from outside the UK |
| Cloudflare, Inc. | Network edge services. All traffic to bluto.ai and the platform passes through Cloudflare, which terminates the encrypted connection and forwards requests to our infrastructure | IP addresses and request metadata, including the page requested, browser type and approximate location derived from IP address. No Customer Content | Global edge network | SCCs |
| Hetzner Online GmbH | Virtual server hosting for internal systems supporting our operations | The content of support enquiries, which may include any personal data a Subscriber includes in a message to us | Germany (Nuremberg) | Adequacy |
*Amazon Web Services maintains ISO 27001 and SOC 2 Type II certification for the infrastructure services listed above.
03Payment Processing
How subscription payments are processed.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Stripe, Inc.* | Subscription billing, payment processing and payment method management | Billing name, billing address, payment confirmation data and subscription status. Stripe processes card details directly; we do not receive or store card numbers | United Kingdom and European Union | SCCs |
*Stripe maintains PCI-DSS Level 1, ISO 27001 and SOC 2 Type II certification.
04AI and Document Processing
The providers supplying AI and document processing components.
4.1 As set out in clause 1.4, the providers below supply components within Bluto's own AI architecture. They do not have access to Subscriber account data, billing data, or Customer Content beyond the specific inputs sent to them.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Anthropic, PBC | AI model provider | Inputs sent to AI features within the platform. Where a support enquiry is handled with AI assistance, the content of that enquiry. Operational logs sent for diagnosis, which may incidentally contain personal data. Inputs are not retained for model training* | United States | SCCs |
| Google Cloud (Document AI) | Document data extraction | The content of receipts and invoices submitted to the Service, including supplier names, amounts, dates and any personal data contained in the document itself | Google Cloud infrastructure | SCCs where processing takes place outside the UK |
*Our agreement with Anthropic confirms that inputs are not used to train or improve Anthropic's models and are not retained after the request is processed.
05Communications
How email is sent, received and hosted.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Outbound and inbound email. Outbound covers transactional messages including account verification, password reset, billing notifications and service alerts. Inbound receives documents forwarded to a Bluto address for processing* | Subscriber name and email address, the content of transactional messages, and email delivery events. For inbound email, the message content and any attached documents | United Kingdom (London) | United Kingdom; SCCs for support access from outside the UK |
| Microsoft Ireland Operations Limited | Hosted email for bluto.ai addresses, including the shared mailboxes used for support and billing correspondence | The name, email address and message content of anyone corresponding with Bluto by email | Ireland | Adequacy† |
*Documents received by inbound email are stored as documents in the London region and are treated as Customer Content.
†Where Microsoft support personnel access data from outside the United Kingdom or European Economic Area, SCCs are relied upon.
06Error Monitoring
How we detect and diagnose faults in the Service.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Sentry GmbH | Error monitoring. When the Service encounters an unexpected fault, a report is sent to Sentry so that we can diagnose and fix it | The technical context of the error, including the IP address of the request, the operation concerned, and the state of the system at the time* | Germany | Adequacy |
*Error reports are not intended to contain Customer Content. A fault occurring while the Service is processing Customer Content may include a fragment of it in the report.
07Security Monitoring
How our infrastructure is monitored for security issues.
| Vendor | Service | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Sophos Limited | Security scanning and configuration monitoring of our cloud infrastructure | Technical security telemetry, including configuration state and system activity metadata. No Customer Content | United Kingdom and Sophos cloud infrastructure | United Kingdom; SCCs where processed outside the UK |
Change log
2026-09-04 · Version 1.0
First publication of the Bluto Subprocessor List.