Authorized Sub-processors for Bardo Services

Bardo engages a small number of carefully-vetted service providers (“sub-processors”) to help deliver, secure and maintain our products. Each sub-processor only receives the minimum personal data necessary for its task, and all are bound by written data-processing agreements that meet or exceed GDPR requirements.

Why we use sub-processors

Our cloud-native stack relies on specialist infrastructure and content-delivery partners so we can offer you high availability, rapid performance and robust security worldwide.

Before onboarding any vendor, we:

Confirm ISO 27001, SOC 2 Type II or equivalent certifications

Require the vendor to support data-subject rights and maintain incident-response procedures.

Sign the latest EU Standard Contractual Clauses (or rely on an adequacy decision);

Current Third-Party Sub-processors

(as of October 16th, 2025)

Sub-processor	Service	Typical Data	Purpose	Primary Locations	Transfer Basis
Microsoft Azure	Cloud infrastructure, managed databases and machine learning workloads	Customer source data, bardo-generated data (always encrypted at rest)	Host the Bardo platform and store customer data	Sweden	Data Processing Agreement (DPA)
Google Cloud Platform (GCP)	Analytics, data processing & machine-learning workloads	Transformed customer data without personal information	Usage analytics and product-improvement experiments	Sweden	Data Processing Agreement (DPA)
Cloudflare, Inc.	Global CDN, WAF, DDoS mitigation	IP addresses, TLS handshake data, request headers (edge-cached ≤ 24 h)	Accelerate content delivery and protect against attacks	Global edge network (data stays at closest PoP)	EU Standard Contractual Clauses (2021/914) + Cloudflare's approved Controller-to-Processor Binding Corporate Rules
Vercel, Inc.	Edge functions & preview deployments	Build artefacts, preview URLs, pseudonymised IDs	Serve Bardo Customer Application, as well as preview environments to customers and QA teams	Global edge network (data stays at closest PoP)	EU Standard Contractual Clauses (2021/914)

Sub-processor	Service	Typical Data	Purpose	Primary Locations	Transfer Basis
Microsoft Azure	Cloud infrastructure, managed databases and machine learning workloads	Customer source data, bardo-generated data (always encrypted at rest)	Host the Bardo platform and store customer data	Sweden	Data Processing Agreement (DPA)
Google Cloud Platform (GCP)	Analytics, data processing & machine-learning workloads	Transformed customer data without personal information	Usage analytics and product-improvement experiments	Sweden	Data Processing Agreement (DPA)
Cloudflare, Inc.	Global CDN, WAF, DDoS mitigation	IP addresses, TLS handshake data, request headers (edge-cached ≤ 24 h)	Accelerate content delivery and protect against attacks	Global edge network (data stays at closest PoP)	EU Standard Contractual Clauses (2021/914) + Cloudflare's approved Controller-to-Processor Binding Corporate Rules
Vercel, Inc.	Edge functions & preview deployments	Build artefacts, preview URLs, pseudonymised IDs	Serve Bardo Customer Application, as well as preview environments to customers and QA teams	Global edge network (data stays at closest PoP)	EU Standard Contractual Clauses (2021/914)

See how your data performs in a quick CSRD check

Book a demo, or open the ROI calculator to estimate time and cost.

Book Demo