Sub-processors
Effective 4 July 2026
To provide BeeShelf we rely on a small, vetted set of sub-processors. Each is used for a specific, limited purpose. We host primary data in the European Union and keep this list current; we’ll give notice of material changes to institutions before a new sub-processor starts processing their data, as set out in the Data Processing Addendum.
| Sub-processor | What it does | Processing location | Data involved |
|---|---|---|---|
| Supabase | Managed PostgreSQL database, authentication, and file storage — the primary data store. | European Union (Frankfurt, Germany) | All library & account data |
| Fly.io | Application hosting (the servers that run BeeShelf). | European Union (Frankfurt, Germany) | Processed in transit / memory |
| Cloudflare | CDN, DNS, DDoS protection, and hosting for the marketing website. | Global edge network | Request metadata (e.g. IP) in transit |
| Resend | Transactional email delivery (verification links, notices, password resets). | United States | Recipient email address & message content |
| Stripe | Subscription billing and payment processing (via iBX). Card data is handled by Stripe directly. | United States / global | Billing contact & payment data |
| Anthropic | Optional AI features: catalogue enrichment, natural-language reporting, and cover scanning. Enabled per feature/library. | United States | Only the text/images submitted to those features |
| Google Books API | Bibliographic lookups (ISBN / title → book metadata). A data source, not a personal-data processor. | United States / global | None (search queries only, no personal data) |
| Google Analytics | Aggregate traffic analytics for the public marketing website (beeshelf.com) ONLY — never loaded in the BeeShelf application, so no reader/staff activity reaches it. | United States / global | Marketing-site visitor usage data (pages, referrer, country) |
For transfers of personal data outside the EU/EEA (for example, to a US-based provider above), we rely on appropriate safeguards such as Standard Contractual Clauses and the providers’ own certifications.
Questions about a sub-processor? Email hello@beeshelf.com.