// subprocessors
Every third party in the path, what it actually receives, and where. Not a generic vendor list — the specific data each one sees.
A subprocessor list is only useful if it says what each provider receives. Several below never see your monitoring data at all: Twilio sees a phone number and a sentence, Polar sees a billing identity and never your infrastructure. Listing them together without that distinction would be technically complete and practically useless.
| Provider | Purpose | What it receives | Location | DPA |
|---|---|---|---|---|
| Cloudflare | Application and marketing hosting, edge security, the scheduled work that drives collection, and object storage | Request logs and structured diagnostics. No credentials, alert destinations or raw telemetry are logged. | Global edge | Standard ToS; DPA available |
| Supabase | Authentication and the control-plane database — your account, organizations, integrations, services, incidents and alerts | Identity, encrypted integration credentials, monitoring configuration and history | United States (us-east-1) | Available and accepted |
| Tinybird | Telemetry storage for OpenTelemetry metrics you push to Beaam | Metric samples, expiring after 30 days | Managed service | Available |
| Resend | Email — alerts, the daily heartbeat, and account mail such as confirmation and password reset | Your email address and the alert content sent to it | United States | Available |
| Twilio | SMS alert delivery (Solo plan) | Your phone number and the alert text | United States, global carrier delivery | Available |
| Expo | Mobile push notification delivery | Device push tokens and notification content | United States, global delivery | Standard terms |
| Polar | Merchant of record — checkout, subscriptions, invoicing and tax | Billing identity and payment records. Beaam never sees your card details. | European Union / United States | Standard merchant-of-record terms |
| Amazon Web Services | Email delivery for the independent watchdog only — deliberately a different provider from the main alert path | The founder's contact address and watchdog alert content | Australia (ap-southeast-2) | Standard terms |
| Anthropic | AI incident explanations — used only if your organization turns them on (off by default) | When enabled, a short incident evidence summary: affected service names, timings, and detected changes. No raw metrics, credentials, or personal data; not used for training. | United States | Available |
| Plausible | Traffic analytics for the beaam.app marketing site only — never the application | Page URL, referrer, and coarse browser, OS and country. Cookieless, with no cross-site identifier and no IP address stored. Signed-in application activity is not sent here. | European Union | Available |
The watchdog uses a different email provider on purpose. If Beaam's alert path fails because Resend is down, an alert about that failure sent through Resend would not arrive. The watchdog runs on a separate cloud account and sends through AWS, so the thing telling you Beaam is broken does not depend on the parts of Beaam that might be broken.
Your credentials are encrypted before they reach Supabase. Integration credentials are encrypted with AES-256-GCM using a key held as a deploy secret, so the database holds ciphertext. A Supabase compromise would not by itself yield access to your AWS account.
The only analytics processor sees the marketing site, not the product. Plausible counts visits to beaam.app — cookieless, EU-hosted, no cross-site identifier, no IP address stored — because running a business on zero idea of what people read is not a privacy position, it is a guess. It is never loaded inside the application, so nothing you do while signed in reaches it. There is still no Google Analytics, no Segment, no session recording, no tracking pixels, and no cookies beyond the session cookie. Product analytics remain first-party, stored in the same database as everything else, and no third party is building a profile of you across the web. Added 16 August 2026; before that there was no analytics processor at all.
Card details never touch Beaam. Polar is the merchant of record, which also means they handle sales tax and VAT for your jurisdiction rather than a solo founder filing in forty of them.
The control-plane database is in the United States (us-east-1); the application runs on Cloudflare's global edge. Beaam does not currently offer regional data residency, EU-only processing, or a choice of database region. If that is a hard requirement, Beaam is not the right fit today — and that is a limitation worth knowing before you connect anything rather than after.
The data Beaam holds about you is minimal and yours: an email address, optionally a phone number, your monitoring configuration, and telemetry from systems you connected. Raw metric samples expire after 30 days. Deleting your account removes your identity and control-plane records immediately; processors retain what their own legal obligations require.
Beaam is not SOC 2 or ISO 27001 certified and does not claim to be. Formal GDPR posture is "sufficient, not certified" — minimal user-owned data and no cross-site tracking, which covers most of what the regulation is concerned with, without an audit to prove it. If you need a signed DPA of your own or a compliance questionnaire completed, email support@beaam.app and you will get an honest answer about what can and cannot be provided today.
This list is maintained alongside the retention inventory in the codebase, so it changes in the same commit as the thing it describes. Adding a processor that receives customer data is a change we will announce on the changelog, not one that appears quietly here.
Last updated 16 August 2026.