BOSS-IQ Public Sub-Processor List
Service: BOSS-IQ (https://boss-iq.io) — operated by Blueprint IQ Yazılım ve Danışmanlık AŞ (“Blueprint IQ AŞ”) Last updated: [DATE] Questions / objections: privacy@boss-iq.io
How we use sub-processors
To run BOSS-IQ, we engage trusted third-party providers (“sub-processors”) to host infrastructure, run AI analysis, parse documents, power search, deliver email, process voice, and handle payments. We do share your data with the providers below, for the specific purposes stated, under contractual data-protection terms. We do not sell your data, and we do not share it for any provider’s independent purposes.
This list is the single source of truth for who processes BOSS-IQ customer data. It is referenced by our Privacy Policy and Data Processing Agreement.
Change notice & objection window: We will give at least 30 days’ advance notice before adding or replacing a sub-processor that processes personal data — by email to account administrators and/or by posting an updated version of this page. Customers may object on reasonable data-protection grounds within that window as described in the DPA (Section 6).
Where your data lives (residency summary)
- The two largest and most sensitive stores — our database and your uploaded files — are hosted in the European Union (Amsterdam).
- Only derived and AI-related data is processed in the United States: the search index, AI-quality tracing, and the AI/voice providers that perform the analysis.
- These US transfers are the ones covered by our cross-border safeguards (EU Standard Contractual Clauses + KVKK cross-border mechanism), as described in the Privacy Policy (Section 7) and DPA (Section 9).
Current sub-processors
| # | Sub-processor | Purpose | Customer data category | Processing region | Trains on your data? | DPA status |
|---|---|---|---|---|---|---|
| 1 | Anthropic | Core AI reasoning engine (analysis, strategy, document generation) | All business content you submit | US | No (confirmed — Development Partner Program not joined; user-feedback off; 30-day provider retention for safety monitoring) | In progress |
| 2 | OpenAI | Document search indexing (text embeddings) | Document text fragments | US | No (business/API default — confirming account tier) | In progress |
| 3 | Unstructured.io | Document parsing (PDF/DOCX/PPTX/image → text) | Complete uploaded files | US | No (per vendor terms — confirming) | In progress |
| 4 | Pinecone | Search memory (vector index + short text previews) | Document fragments (up to ~500-char previews) + identifiers | US (AWS us-east-1, confirmed) | No (storage/search vendor) | In progress |
| 5 | Tigris (via Railway) | File and object storage | All uploaded documents + generated artifacts | EU — Amsterdam (confirmed) | No (storage vendor) | In progress |
| 6 | Railway | Hosting (application, database, queue/cache compute) | All data (infrastructure) | EU West — Amsterdam (confirmed) | No | In progress |
| 7 | Vercel | Web application delivery (frontend hosting) | Rendered content / requests | US / global edge (confirming) | No | In progress |
| 8 | Clerk | Sign-in and identity management | Names, emails, organization membership | US (confirming) | No | In progress |
| 9 | LangSmith (LangChain Inc.) | AI quality monitoring / tracing | Full AI conversation records (tracing is active) | US | No (observability vendor) | In progress (required — tracing active; access restricted to the founder; 14-day trace retention) |
| 10 | Cartesia | Voice narration (text-to-speech) | AI-written strategy summaries (narration text) | US (confirming) | No (per vendor terms — confirming) | In progress |
| 11 | ElevenLabs | Voice input (speech-to-text) | Your voice audio (sent browser-direct; biometric-class) | US (confirming) | No (per vendor terms — confirming) | In progress — priority (biometric) |
| 12 | Dodo Payments | Payments (Merchant of Record) | Billing/checkout metadata only (no card data on our side) | Confirming | No | Standard Merchant-of-Record terms |
| 13 | Hostinger | Email delivery + inbound mailbox | Email addresses + strategy documents attached to email | EU (confirming) | No | In progress |
Notes on specific categories
- Voice audio (ElevenLabs). If you use the microphone, your spoken audio is sent directly from your browser to our speech-to-text provider; it does not transit our servers. Voice recordings are biometric/special-category data, processed only with your explicit consent — see the Privacy Policy, Section 3.4.
- AI providers and training. Our AI providers (rows 1–2) operate under commercial terms under which they do not train their models on data submitted through their business APIs. We verify and maintain this posture; see the Privacy Policy, Section 5.
- AI-quality tracing (LangSmith). Our AI-quality monitoring provider receives a copy of AI conversations so we can monitor and improve service quality. Access is restricted to the founder, and traces are automatically deleted after 14 days.
- No customer data to certain providers. Some providers process only infrastructure-level or identity data (e.g., hosting, sign-in) and do not use it for their own purposes.
- Our own AI-improvement archive (not a sub-processor). Separately from the providers above, we keep an internal archive of interaction data that we may use to evaluate and improve our AI. This is our processing — disclosed in the Privacy Policy (Section 5), where you can also opt out — not a third-party sub-processor.
Region & residency
BOSS-IQ is operated by a Turkish company (Blueprint IQ AŞ). Our database and uploaded files are in the EU (Amsterdam); several other sub-processors are based in or process data in the United States. Where data is transferred outside Türkiye/the EEA, we rely on appropriate cross-border transfer mechanisms (EU Standard Contractual Clauses + KVKK undertakings) as described in the Privacy Policy (Section 7) and DPA (Section 9).
BOSS-IQ is a product of Blueprint IQ AŞ.