Blufor Tender sub-processors and service providers
Last updated: 2026-09-24. Customers are told at least 30 days before a new sub-processor of customer personal data is added (Data Processing Agreement, Clause 7.7).
Process customer personal data (Annex IV of the DPA)
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, database, storage, logs; Vertex AI (Gemini) suggests search terms from the product names and descriptions on a company profile (not used by Google to train models) | EU (Belgium) for hosting; Vertex AI requests are processed within EU member states (Vertex AI EU multi-region endpoint) |
| Google Firebase Authentication / Identity Platform | Sign-in | May process outside the EU under Google's transfer safeguards |
| Brevo (Sendinblue SAS) | Alert and digest emails | EU (France) |
| Sentry (Functional Software, Inc.) | Error diagnostics (pseudonymous user ids, emails masked) | [EU region — confirm] |
Other providers (no customer workspace data)
| Provider | Purpose | What they receive |
|---|---|---|
| Stripe Payments Europe, Limited (Ireland) | Card payments and subscriptions | Billing contact, company details and VAT number; card data goes to Stripe directly, never to Blufor Tender. Stripe processes the payment and is a controller in its own right for fraud prevention and its legal obligations. Blufor Tender is the seller and issues the invoice. Processing by Stripe group companies outside the EU is covered by the EU–US Data Privacy Framework or standard contractual clauses |
| Google Cloud Translation API | English translations of public tender titles | Public tender titles only |
| Anthropic (only if agentic listing extraction is enabled for a source) | Reading a public tender listing page when no stable selector exists | The public listing page only; off by default |
| Google Workspace | Company email and documents | Correspondence with customers |