Sub-processors
Last updated April 20, 2026
This page lists the sub-processors Dunamis Studios (Joshua Robert Bradford d/b/a Dunamis Studios) engages to deliver the Debrief HubSpot application and the dunamisstudios.net website. It is incorporated by reference into the Privacy Policy and the Data Processing Addendum as Annex 4.
Dunamis Studios commits to at least thirty (30) days’ advance notice of any intended addition or replacement of a sub-processor that will process Customer Personal Data. To receive notice by email, subscribe by sending a one-line message to privacy@dunamisstudios.net. Customer may object to a new sub-processor on reasonable data-protection grounds within the notice period; if the objection cannot be resolved, termination of the affected subscription is the remedy.
Honest upstream asymmetry. Anthropic, our LLM sub-processor, commits to only fifteen (15) days’ notice of changes to its own sub-processors upstream of us. Where we receive shorter upstream notice, we pass the change through to customers as soon as practicable, which may be shorter than our 30-day commitment.
Sub-processors that process Customer Personal Data
| # | Legal name | Purpose | Location | EU→US transfer mechanism | DPF status | DPA |
|---|---|---|---|---|---|---|
| 1 | Anthropic, PBC | LLM inference for generating handoff briefs via the Claude API | United States (AWS + GCP) | SCCs Modules 2 & 3 + UK Addendum + Swiss Addendum | Not certified | Auto-incorporated in Anthropic Commercial Terms |
| 2 | Vercel, Inc. | Application hosting, serverless functions, edge network, request logs | United States (customer-region selectable) | EU-US DPF + UK Extension + Swiss-US DPF (primary); SCCs fallback | Certified (all three) | vercel.com/legal/dpa |
| 3 | Upstash, Inc. | Redis storage for app state, brief metadata, session cache | United States (default AWS us-east-1; EU region available AWS eu-west-1) | EU-US DPF + UK Extension + Swiss-US DPF; SCCs fallback | Certified (all three) | upstash.com/trust/privacy.pdf |
| 4 | Stripe, Inc. | Payment processing, subscription billing | United States (primary), regional processing | EU-US DPF + UK Extension + Swiss-US DPF; SCCs; CBPR/PRP | Certified (all three) | stripe.com/legal/dpa |
| 5 | Drforest, Inc. (d/b/a Resend) | Transactional email delivery | United States | EU-US DPF + UK Extension + Swiss-US DPF; SCCs fallback | Certified | resend.com/legal/dpa |
Authorized data source (not a sub-processor, strictly)
HubSpot, Inc. Customer has already engaged HubSpot as its processor for CRM data independently of Dunamis Studios. Debrief is a HubSpot marketplace application that reads Customer’s HubSpot data under the OAuth authorization Customer grants at install. HubSpot is listed here for transparency; the flow from Customer’s HubSpot portal into Debrief is governed by Customer’s own agreement with HubSpot and by this Dunamis Studios DPA.
Operational tooling: does not receive Customer Personal Data
The following services support Dunamis Studios’s internal operations (collaboration, source control, credential management, accounting). They do not receive or process Customer Personal Data and are therefore not sub-processors in the GDPR Article 28 sense. They are listed here for transparency.
- Google Workspace (Google LLC): internal email, calendar, documents.
- GitHub (GitHub, Inc.): source control for Dunamis Studios code.
- 1Password (AgileBits Inc.): credential and secrets vault.
- Accounting and tax preparation software used for internal bookkeeping.
Contact and subscription to updates
Questions or objections regarding sub-processors: privacy@dunamisstudios.net. Data-protection escalations and DPA matters: legal@dunamisstudios.net. Postal address: Joshua Robert Bradford d/b/a Dunamis Studios, 2269 Twin Fox Trail, St. Augustine, FL 32086, United States.