LEGAL
Benchyard Subprocessors and Service Providers
Deployment register. Complete the inventory below before publication as an active provider list or attachment to an executed DPA. A pending entry does not authorize processing.
Version: 0.2 | Last updated: October 10, 2026
This document distinguishes providers engaged by Benchyard from services customers select independently. Contact hello@benchyard.com, subject "Subprocessors," for provider information or change notices.
1. Providers engaged by Benchyard
The actual production inventory has not yet been supplied for this revision. The following rows identify the information needed; they do not assert that a particular supplier or processing country has been selected. Complete each applicable row from the actual contract and deployment, and remove unused rows.
| Function | Data potentially processed | Required production entry |
|---|---|---|
| Workspace hosting and snapshots | Code, files, agent context, credentials stored in workspaces, execution and resource records | Provider legal entity; hosting and access countries; services used; processing agreement; transfer safeguards |
| Database hosting | Accounts, session mirror, search, protected credentials, settings, usage and audit records | Provider legal entity or underlying host; storage and access countries; processing agreement; transfer safeguards |
| Object storage and recovery backups | Attachments, session bundles, feedback images, and backed-up data | Provider legal entity; storage, replica and access countries; deletion cycle; processing agreement; transfer safeguards |
| Network delivery and security | IP addresses, request metadata and content where handled | Provider legal entity; functions and countries; processing agreement; transfer safeguards |
| Email and support | Contact details, messages, optional support materials and delivery records | Provider legal entity; functions and countries; processing agreement; transfer safeguards |
| Secrets management | Infrastructure credentials and any customer credentials entrusted to the service | Provider legal entity; actual credential scope; countries; processing agreement; transfer safeguards |
| Push delivery | Device endpoints and notification payloads | Browser or operating-system service providers; payload protection; locations; applicable roles and terms |
A directly operated database is not a separate legal-entity subprocessor merely because it is separate software. Identify its underlying host and Benchyard's own access. Include remote support and administrative access in the location assessment. Consolidate suppliers performing multiple functions without losing the full data scope.
2. Payment services
Airwallex is the intended payment platform described by the owner. Its exact contracting entity, merchant account, applicable notices, processing roles and locations must match the actual seller and checkout. An existing account held by one company is not evidence that a future company may use it as its merchant account. Payment providers may act independently for compliance, fraud prevention, or other specified purposes and as processors for other functions; record the actual arrangement.
3. Customer-selected services
Customers may select external coding agents, model services, repository hosts, tools, plugins, and endpoints where permitted. Technical support for a connection does not establish that its provider is a Benchyard subprocessor or that access is authorized for every deployment.
Where a customer independently contracts with and selects a provider, that provider's separate processing is governed by the customer's arrangement. Where Benchyard engages a provider to process data on Benchyard's behalf, include it in the completed inventory and apply the required contractual protections. The classification depends on actual instructions, routing, credential handling, and contracts.
4. Changes and acceptance record
For customers with an effective Data Processing Addendum, Benchyard gives at least 30 days' prior written notice of a proposed new or replacement subprocessor and follows the DPA's objection procedure. Updating a public page alone does not replace that notice.
The completed register must record its verification date, responsible approver, applicable deployment, provider contracts and transfer instruments, and the version attached to each accepted DPA. No production provider entry or transfer safeguard has been verified by this template.