BLEND SUB-PROCESSOR LIST

Microsoft (Microsoft Ireland Operations Ltd)

Productivity, email and file collaboration (Microsoft 365), used to store and transmit project communications and work product that contain personal data.

UK and EU data residency.

Ziflow Ltd

Online proofing and review of deliverables, which involves personal data of the customer’s personnel and agents.

USA. Transfers are based on Ziflow’s certification under the EU-US Data Privacy Framework and its UK Extension (UK-US Data Bridge).

Anthropic PBC

The Claude AI platform, including Claude Code, used to generate, analyse and edit content and data on Blend’s instructions in support of the services. Contracted so that customer data isn’t used for model training.

USA. Transfers are made under the EU Standard Contractual Clauses (Module 3, processor to processor) and the UK International Data Transfer Addendum, as incorporated in Anthropic’s data processing addendum.

Laravel Cloud (Laravel LLC)

Hosting of BlendCore, Blend’s internal knowledge platform, which holds approved project material used to deliver the services. BlendCore runs on dedicated infrastructure provisioned through Laravel Cloud on Amazon Web Services, with each customer’s instance isolated on a regional server.

Customer data is stored in a UK or EEA region (London, Dublin or Frankfurt). Laravel LLC is established in the USA and its support personnel may access the hosting environment from the USA; any such access is based on Laravel Cloud’s certification under the EU-US Data Privacy Framework and its UK Extension. Laravel Cloud holds ISO/IEC 27001 certification and a SOC 2 Type 2 report.

AskElephant, Inc.

Meeting capture, transcription and AI summarisation of calls and meetings relating to the services, which may include personal data of the customer’s personnel and contacts who take part. Contracted and configured so that customer data isn’t used for model training.

USA. Transfers are made under the EU Standard Contractual Clauses and the UK Addendum, as incorporated in AskElephant’s data processing addendum. AskElephant holds a SOC 2 Type II report and maintains HIPAA compliance. Its own sub-processors (including Recall.ai, Deepgram, Anthropic, OpenAI and ElevenLabs) are located in the USA and are contractually prohibited from retaining customer data beyond what processing requires, or from using it to train any model.