Authorized Sub-processors for Bardo Services

Bardo engages a small number of carefully-vetted service providers (“sub-processors”) to help deliver, secure and maintain our products. Each sub-processor only receives the minimum personal data necessary for its task, and all are bound by written data-processing agreements that meet or exceed GDPR requirements.

Why we use sub-processors.

Our cloud-native stack relies on specialist infrastructure and content-delivery partners so we can offer you high availability, rapid performance and robust security worldwide.

Before onboarding any vendor, we:

×

Confirm ISO 27001, SOC 2 Type II or equivalent certifications.

×

Require the vendor to support data-subject rights and maintain incident-response procedures.

×

Sign the latest EU Standard Contractual Clauses (or rely on an adequacy decision).

Current Third-Party Sub-processors.

(as of June 4th, 2026)

Microsoft Azure

Service

Cloud infrastructure, managed databases and machine learning workloads

Typical Data

Customer source data, bardo-generated data (always encrypted at rest)

Purpose

Host the Bardo platform and store customer data

Primary Locations

Sweden

Transfer Basis

Data Processing Agreement (DPA)

Google Cloud Platform (GCP)

Service

Analytics, data processing and machine-learning workloads

Typical Data

Transformed customer data without personal information

Purpose

Usage analytics and product-improvement experiments

Primary Locations

Sweden

Transfer Basis

Data Processing Agreement (DPA)

Amazon Web Services (AWS)

Service

Analytics, data processing and machine-learning workloads

Typical Data

Transformed customer data without personal information

Purpose

Usage analytics and product-improvement experiments

Primary Locations

Sweden

Transfer Basis

Data Processing Agreement (DPA)

Cloudflare, Inc.

Service

Global CDN, WAF, DDoS mitigation

Typical Data

IP addresses, TLS handshake data, request headers, edge-cached for up to 24 hours

Purpose

Accelerate content delivery and protect against attacks

Primary Locations

Global edge network, data stays at closest PoP

Transfer Basis

EU Standard Contractual Clauses (2021/914) + Cloudflare's approved Controller-to-Processor Binding Corporate Rules

Auth0

Service

Identity management, authentication and authorization

Typical Data

User credentials, email addresses, authentication metadata, role assignments

Purpose

Authenticate end users and manage roles and permissions (RBAC) for the Bardo platform

Primary Locations

EU (Frankfurt)

Transfer Basis

EU Standard Contractual Clauses (2021/914)

Twilio SendGrid

Service

Transactional email delivery

Typical Data

Recipient email addresses, message subject and body content, including data-room invitations and export-complete notifications

Purpose

Deliver transactional email to platform users and invited collaborators

Primary Locations

USA

Transfer Basis

EU Standard Contractual Clauses (2021/914) + Data Processing Agreement (DPA)

New Relic

Service

Application monitoring and observability

Typical Data

Application telemetry, error stack traces, tenant identifiers and request metadata

Purpose

Monitor application performance, detect errors and alert on incidents

Primary Locations

EU

Transfer Basis

Data Processing Agreement (DPA)

Linear

Service

Issue tracking and feedback management

Typical Data

User-submitted feedback content and submitter identifier

Purpose

Track in-product user feedback as engineering issues

Primary Locations

EU

Transfer Basis

Data Processing Agreement (DPA)

Exa.ai

Service

Web search and content retrieval

Typical Data

Search queries derived from customer activity data, such as product names and descriptions

Purpose

Retrieve web content for emission-factor research and derivation

Primary Locations

USA

Transfer Basis

EU Standard Contractual Clauses (2021/914)

Tavily

Service

Web search

Typical Data

Non-identifying product/category keywords

Purpose

Web search to support emission-factor research harvesting workflows

Primary Locations

USA

Transfer Basis

EU Standard Contractual Clauses (2021/914) + UK Addendum

SerpAPI

Service

Search engine results retrieval

Typical Data

Flight routes and travel queries derived from customer activity

Purpose

Retrieve search engine results for flight emission-factor lookups

Primary Locations

USA

Transfer Basis

EU Standard Contractual Clauses (2021/914)

Try for yourself

See what we'd find in your data.

We'll analyze a sample of your source documents and show you what real carbon data looks like for your organization.
See it in action
MessagesSquare Talk to our team
Ellipse 2 (1)