Sub-Processors

Current list of third-party sub-processors used by Blue to provide the Service.

Last updated: July 8, 2026

Blue engages the following third-party sub-processors to assist in providing the Service. This page is the canonical and authoritative list of sub-processors referenced by our Data Processing Agreement and Business Associate Agreement.

Changes to this list are subject to the notification and objection procedures set forth in Section 4.2 of the Data Processing Agreement.

Current Sub-Processors

Sub-ProcessorCategoryPurposeData Location
HetznerInfrastructureHosting and computeEU (Germany)
Amazon Web ServicesInfrastructureSES email deliveryEU (Frankfurt)
BackblazeInfrastructureFile storageEU
CloudflareInfrastructureDNS, CDN, securityGlobal
StripePaymentsPayment processingUS
AppleMobileiOS app distribution and App Store servicesUS
GoogleMobileGoogle Play Store, Firebase Push NotificationsUS
TelegramTeam OperationsInternal team notificationsGlobal

Blue does not send Customer content to any AI provider under Blue’s own account or API key. Blue’s in-product AI features operate under a “bring your own key” model — see the section below.

Customer-Configured AI Providers (Bring Your Own Key)

Blue’s in-product AI features (such as the AI assistant available in record comments) run under a “bring your own key” model: AI inference is performed using your own account and API key with the AI provider you select and configure in your organization’s AI settings. Blue does not maintain its own account, API key, or billing relationship with these providers for this Processing, and does not route your data through them under Blue’s own credentials.

Because you choose and control the provider, these providers are engaged by you rather than by Blue on its own behalf: they process your data under your account, at your configuration, and are governed by the agreement between you and that provider (including that provider’s data-retention and model-training settings). We list them here for full transparency:

AI ProviderRoleData Location
OpenAICustomer-configured AI model providerDetermined by your provider account and configuration
AnthropicCustomer-configured AI model providerDetermined by your provider account and configuration
GoogleCustomer-configured AI model providerDetermined by your provider account and configuration
OpenRouterCustomer-configured AI routing provider (routes to an underlying model you select)Determined by your provider account and configuration

When you select OpenRouter, your request is transmitted through OpenRouter’s infrastructure before reaching the underlying model, and OpenRouter’s own data and logging policies apply in addition to those of the underlying model you choose.

You can disable AI features and remove your configured API key at any time in your organization’s AI settings. The AI conversation history that Blue stores to provide these features (your prompts, the AI’s responses, and the actions it takes) is held in Blue’s own EU-based systems, covered by the Data Processing Agreement, and deleted when you delete the associated record, workspace, or account, in accordance with our Privacy Policy.

PHI-Authorized Sub-Processors

The following sub-processors are authorized to process Protected Health Information (PHI) under a Business Associate Agreement. All other sub-processors listed above are not authorized to process PHI.

Sub-ProcessorPurpose
HetznerHosting and compute
Amazon Web ServicesSES email delivery
BackblazeFile storage
CloudflareDNS, CDN, transit security

Changes

Blue will notify customers of changes to this sub-processor list with at least 30 days’ prior notice, in accordance with the procedures set forth in the Data Processing Agreement. Customers may object to the appointment of a new sub-processor within 14 days of receiving such notice.

For questions about our sub-processors, contact legal@blue.app.