Sub-Processor List
About This List
This page lists the third-party service providers ("sub-processors") that Spacious Enterprises engages to deliver the Brick-by-Brick Knowledge Architecture Builder service. Each sub-processor has a specific role in service delivery and operates under the data processing terms referenced below.
This list is maintained and versioned independently of our Privacy Policy. When we add, remove, or materially change a sub-processor, this list is updated with a dated entry in the Change Log section at the bottom of this page.
Why this list exists: We provide this list for enterprise customers, procurement teams, data protection officers, and any Architect who wants transparency about the complete infrastructure that supports the Service. Having a dedicated, versioned sub-processor list is a standard enterprise data governance practice.
Current Sub-Processors
Anthropic
| Service | Large language model API (Claude Opus 4.6, Claude Sonnet 4.6) |
|---|---|
| Purpose | AI-powered analysis of company intelligence during the build process. Research, structuring, data analysis, graph construction, gap analysis, analytical table generation, and conversation-based data confirmation. |
| Data Categories Processed | Company-specific data provided during the build, including financial, strategic, operational, human architecture, market, relationship, and temporal data. Public information from web research. Architect-authorized connector data. |
| Data Location | United States |
| Retention by Sub-Processor | Up to 30 days for trust and safety purposes per Anthropic API Terms of Service. Data is NOT used to train Anthropic's models. |
| Transfer Mechanism (for EU/UK data) | Standard Contractual Clauses |
| Policy Reference | Anthropic Privacy Policy |
Cloudflare
| Service | Cloud infrastructure platform — Workers (compute), D1 (database), KV (key-value storage), Durable Objects (session caching), R2 (deliverable storage), AI Gateway (LLM API routing), Pages (frontend hosting) |
|---|---|
| Purpose | Hosts the Brick-by-Brick application. Stores build data temporarily during the build process. Routes LLM API calls to Anthropic with rate-limit management. Serves the website and application frontend. |
| Data Categories Processed | Build session data, connector OAuth tokens (encrypted), deliverable files (HTML Package, JSON Export, Knowledge Architecture Guide), application logs, infrastructure metadata |
| Data Location | Global edge network with primary operations in the United States |
| Retention by Sub-Processor | Per hybrid retention model — build data retained for the longer of 48 hours from session start or 24 hours from delivery, up to 72 hours maximum. See Privacy Policy §6 for full retention schedule. |
| Transfer Mechanism (for EU/UK data) | Standard Contractual Clauses |
| Policy Reference | Cloudflare Privacy Policy |
Stripe
| Service | Payment processing |
|---|---|
| Purpose | Processes all payments for Brick-by-Brick (Initial Build at $499, Scope Assessment at $59, Tier 1-3 Updates). Creates purchase credits in our account management database. Handles refunds and chargebacks. |
| Data Categories Processed | Payment card information, billing details, transaction metadata. We never see or store payment card numbers, CVV codes, or billing addresses. |
| Data Location | United States |
| Retention by Sub-Processor | Per Stripe's data retention policies. We receive and retain only transaction confirmations and Stripe customer identifiers. |
| Transfer Mechanism (for EU/UK data) | Standard Contractual Clauses |
| Policy Reference | Stripe Privacy Policy |
How Sub-Processors Are Engaged
We engage sub-processors only when their service is necessary for Brick-by-Brick to function. Before engaging a sub-processor, we evaluate:
- Necessity — Is this sub-processor required to deliver the Service, or is it a convenience?
- Data minimization — Can we limit the data categories shared with this sub-processor to only what is necessary?
- Security posture — Does the sub-processor meet baseline security requirements including encryption in transit, encryption at rest where applicable, and security certifications?
- Data location — Where will data be processed, and are appropriate transfer mechanisms available for EU/UK/California data subjects?
- Alignment with our data governance commitments — Does engaging this sub-processor create any conflict with our Zero Customer Data Holding policy or our no_silent_losses architectural commitments?
Change Notifications
When we add, remove, or materially change a sub-processor, we:
- Update this page with a dated entry in the Change Log section below.
- Update the Privacy Policy's "Effective Date" if the change is material.
- Notify Architects with active builds by email if the change affects data processing during their in-flight builds.
Subscribing to change notifications: To receive email notification when this Sub-Processor List changes, email [email protected] with "Subscribe: Sub-Processor Changes" in the subject line. We will add you to the distribution list for future changes. Unsubscribe at any time by emailing the same address with "Unsubscribe" in the subject line.
Enterprise customers with a Data Processing Agreement (DPA) in place receive change notifications automatically per the DPA terms.
Change Log
| Date | Version | Change |
|---|---|---|
| April 2026 | 1.0 | Initial publication. Sub-processors: Anthropic, Cloudflare, Stripe. |
Future changes will be added to this log with a dated entry describing what changed and why.
Contact
For questions about this Sub-Processor List or our data governance practices:
Spacious Enterprises LLC
Privacy: [email protected]
Legal: [email protected]
Website: brick-by-brick.ai
For our full privacy framework, see the Privacy Policy.
For a technical overview of our data protection practices, see How We Protect Your Data.