1. Reading and scope of the list
This list describes the functions of the service providers used or available according to the integrations. Not all of them intervene in each processing. Some, notably payment and identity services, may act as separate processing controllers for part of their operations.
For a company subcontracting relationship, the contractual annex must identify the contracting entities, their role, the authorized processings and the applicable transfer guarantees. The public list is neither a general authorization from the customer nor proof of the signature of all necessary agreements.
2. Hosting and operation
Amazon Web Services: hosting of the application, database, backups, management of secrets, logs and automations. The main environment of Brunel is in the Europe Paris region. Group services, support operations and global functions must be examined to determine the complete scope of processing locations. Information: AWS data protection.
Vercel: old environment temporarily kept to allow a migration rollback. It may contain historical data. Its removal and associated archives must be handled in the end-of-migration plan; it no longer represents the main hosting of the service.
Cloudflare: DNS management of the domain and, if activated for a given function, anti-abuse protection. DNS management does not mean by itself that Cloudflare hosts the repositories or the customer base. The data processed depends on the functions actually activated. Information: Cloudflare policy.
3. Identity, payment and support
GitHub: authentication and access to authorized repositories, as well as monitoring or writing integrations when they are activated and authorized. Data may include profile, repository references, code and integration events. Information: GitHub policy .
Stripe: payment, subscription management and billing functions. Payment details are processed by Stripe; Brunel uses the references and statuses necessary for service management. Information: Stripe policy.
Discord : optional support platform, account linking and messages exchanged directly in the server. Brunel does not archive messages or attachments in its support database; Discord processes its own content according to its rules. Information: Discord policy.
These service providers may involve international processing. The applicable mechanisms must be examined for the account and the contract actually used; an address or hosting region is not sufficient to describe all transfers.
4. Artificial intelligence and dependencies
Amazon Bedrock: support diagnosis, internal reports and audit analysis when the client's policy allows it. Inference locations depend on the chosen model and profile; an access point in Paris may use routing to other European regions. The residency constraint must be verified on the actual profile.
Anthropic and AI providers chosen by the customer: according to the configuration of the architecture analysis, minimized extracts and messages may be transmitted to the active provider. Its contractual conditions, processing locations and retention periods must be examined. A key provided by the client does not automatically imply no retention.
OpenAI, conditional usage for audits: no transmission of audit data is authorized by the mere presence of a key. A ZDR approval adapted to the used perimeter and the necessary contractual commitments are required. ZDR, MAM and Daybreak credits are not presented as granted to Brunel by default.
OSV, service operated by Google: querying dependency vulnerabilities from component names and versions, without the need to send source code. Processing may concern systems outside the European Economic Area. Information: OSV service.
5. Customer integrations and changes
An identity provider, a Slack or HTTPS webhook, an AI provider and another integration selected by the customer may receive the information necessary for the requested function. The customer must verify the recipients, permissions, data categories and transfer conditions before activation.
For a client with a data processing agreement, authorization and information on changes follow this agreement. A new service provider or a new function is not deemed authorized by the mere modification of this page.
To obtain the contractual register, the entities concerned or the information useful for a supplier review, contact contact@brunel.cloud. The data processing framework and the confidentiality policy complete this presentation.
