Sub-processor Register
Every third party that touches Bid.Guide customer data is listed here, with the data they receive, the region they operate in, and the safeguard we rely on for any cross-border transfer. Subscribe to updates and we'll email you 30 days before any change.
Core infrastructure
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Compute, storage, networking, KMS | All customer data (encrypted) | 🇦🇪 me-central-1 (UAE) · 🇸🇦 me-south-1 / Riyadh | DPA + ISO 27001 + SOC 2 |
| Neon (Postgres) | Primary database | All structured records | 🇦🇪 me-central-1 | DPA + EU SCCs (mirror) |
| Cloudflare | WAF, DDoS, edge CDN | Request metadata, IP | Global edge · controller in EU | EU SCCs |
AI & content processing
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| Anthropic | Claude API — bid drafting, list parsing, notice composition | Prompts you submit + relevant context (tender clauses, firm profile snippets) | 🇺🇸 US · 🇪🇺 EU available | Anthropic DPA · no training opt-in · 30-day zero-retention available on enterprise |
We never share your full bid documents with the AI provider; we only send the specific clauses or fields needed to perform the requested action.
Communications
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| Resend | Transactional email delivery (auth, invites, notices, receipts) | Recipient email, name, message subject + body, message ID, delivery status | 🇪🇺 EU | EU SCCs + DPA |
| Twilio | WhatsApp + SMS for deadline alerts and invites | Recipient phone, message body | 🇪🇺 EU · 🇦🇪 UAE PoP | EU SCCs + DPA |
Identity & KYC
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| Sumsub | KYC + sanctions screening for bidder verification | Identity documents you upload, screening result | 🇪🇺 EU · UAE branch for ME customers | EU SCCs + DPA + ISO 27001 |
| Nafath (KSA) / UAE PASS | Government identity SSO (optional) | Verified identity attestation | 🇸🇦 KSA / 🇦🇪 UAE | Government schemes — no cross-border |
Document workflow
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| DocuSign | e-signature for JV agreements, contracts, regret-acknowledgement | Signer identity, signed documents | 🇪🇺 EU · 🇦🇪 UAE | EU SCCs + DPA |
Observability & security
| Sub-processor | Service | Data accessed | Region | Safeguard |
|---|---|---|---|---|
| Sentry | Error tracking | Stack traces, scrubbed user IDs (no PII payload) | 🇪🇺 EU | EU SCCs + scrubbing rules |
| Datadog | Logs, metrics, APM | Operational telemetry · no Personal Data payload | 🇪🇺 EU | EU SCCs |
Recent changes
- 14 Jun 2026: AWS me-central-1 (UAE) added as primary region. Existing eu-west-1 retained for redundancy on EU-resident customers only.
- 02 May 2026: Anthropic added (Claude Opus) for bid drafting + parser. Zero-retention enabled.
- 18 Mar 2026: Sumsub added for KYC.