Subprocessor List

Brisko uses a limited set of service providers to operate the service. This list identifies the providers used by Brisko's current service architecture.

Current subprocessors

Clerk

Purpose: Identity, authentication, and session management.

Data involved: Account identity information and authentication/session data needed to sign users in securely.

Convex

Purpose: Backend database, application functions, real-time synchronization, and file storage.

Data involved: Account and organization identifiers, inventory and vendor records, counts, purchasing and receiving records, uploads, reports, audit records, and related technical metadata.

Vercel

Purpose: Website delivery, application hosting, and routing feature-initiated model requests through Vercel AI Gateway.

Data involved: Web requests and related network and request metadata needed to deliver Brisko's web application. When an administrator uses connected-account cafe context onboarding, Vercel AI Gateway also processes normalized and redacted excerpts from the selected account's business email and primary calendar, together with the resulting structured model output.

Composio (Sampark Inc.)

Purpose: OAuth connection management and read-only execution against a user's selected Google Workspace or Microsoft 365 account for cafe context onboarding.

Data involved: Brisko-generated opaque user bindings, OAuth credentials managed by Composio, connection metadata, and business email and primary-calendar content and metadata returned for the administrator-requested 90-day review.

Baseten

Purpose: Zero-data-retention AI inference for cafe context onboarding through Vercel AI Gateway.

Data involved: Normalized and redacted business email and primary-calendar excerpts, source type and timestamp context, extraction instructions, and generated structured candidate facts. Brisko configures the route to disallow prompt training and require zero data retention.

Resend

Purpose: Transactional email delivery, including workspace invitations and operational messages.

Data involved: Recipient email addresses and the transactional message content required for delivery.

PostHog

Purpose: Optional product analytics and sanitized client-error analytics. PostHog is used only after a user allows analytics; session replay is disabled.

Data involved: Page and workflow route categories, page interactions, limited workflow-event metadata, sanitized error details, PostHog-generated persistent visitor distinct and device identifiers (including for signed-out visitors), stable Clerk user and organization identifiers and organization role for signed-in users, and browser, device, network, referrer, and timestamp information.

OpenAI

Purpose: AI-assisted extraction, recorded-audio transcription, and inventory voice-command interpretation when a user invokes those features.

Data involved: Submitted text, images, documents, or recorded audio; relevant inventory and vendor context; prompts; and generated outputs.

AssemblyAI

Purpose: Real-time transcription when a user starts live voice control.

Data involved: Live microphone audio, resulting transcript data, transcription instructions, item, brand, vendor, and category vocabulary, active-row details, recent application-result context, and related connection metadata.

Context.dev

Purpose: Company and brand enrichment for vendor setup and lookup.

Data involved: Vendor name, domain, or business email address supplied as lookup evidence, together with returned company, brand, and source information.

Feature-dependent provider use

PostHog is not contacted unless a user allows optional analytics. OpenAI, AssemblyAI, and Context.dev receive information only when the corresponding AI, live-voice, or vendor-enrichment feature is used. Composio, Vercel AI Gateway, and Baseten receive connected-account data only after an administrator explicitly connects Google Workspace or Microsoft 365 and starts cafe context onboarding. Brisko's necessary sign-in and inventory workflows do not depend on allowing PostHog analytics or connecting a work account.

Changes to this list

Brisko may update this list when a provider is added, replaced, or removed. Questions about subprocessors may be sent to hello@brisko.ai.