Last updated: May 29, 2026 — Version 1.1
BK Garage Pro engages the following third-party sub-processors to deliver the platform. All sub-processors are bound by data processing agreements consistent with our Data Processing Agreement and are selected based on their security posture and compliance certifications. We will provide at least 30 days’ notice of material changes to this list.
| Sub-Processor | Category | Purpose | Data Processed | Location | Certifications |
|---|---|---|---|---|---|
| Neon Security Policy ↗ |
Database | Serverless PostgreSQL database. All shop data, customer records, work orders, invoices, vehicle records, and account data are stored here. | All customer and business data entered into the platform | United States (AWS us-east-1) | SOC 2 Type 2, AES-256 at rest, TLS in transit |
| Vercel Privacy Policy ↗ |
Hosting | Application hosting and serverless API compute. Handles TLS termination, DDoS protection, and global edge routing. Data transits Vercel in memory only — not stored. | Request/response data in transit only | United States (edge: global) | SOC 2 Type 2, ISO 27001 |
| Stripe Privacy Policy ↗ |
Payments | Subscription billing and payment processing. Payment card data is collected and stored exclusively by Stripe and never transmitted to BK Garage Pro servers. | Billing information, payment method data, subscription records | United States | PCI DSS Level 1, SOC 2 Type 2 |
| Resend Privacy Policy ↗ |
Transactional email delivery. Routes outbound emails including invoices, estimates, service notifications, and account communications. | Recipient email addresses, message content, delivery metadata | United States | SOC 2 Type 2 | |
| Anthropic Privacy Policy ↗ |
AI | Powers the AI support assistant on the public marketing website only. This assistant is not connected to the platform application and does not process shop or customer data. | Public website chat messages only — no shop or customer data | United States | API data not used for model training by default |