Privacy

Security

Subprocessors

BASE uses infrastructure, AI, communication, payment, analytics, storage, and monitoring providers to operate the product. Some providers are used only when the related feature is enabled or when you choose to use it.

Last updated: May 19, 2026

How to read this list

  • Core infrastructure providers process data needed to run, secure, monitor, and support the app.
  • Voice, payment, and analytics providers process data only for the related feature or when consent is required.
  • Analytics that are not strictly necessary should load only after user consent.
  • Uploaded documents, financial records, wellness records, and call context remain permission-based inside BASE workflows.

Core AI processing

Anthropic

Core service

Purpose: AI reasoning for user-requested agent responses.

Data: Prompts, conversation context, and user-approved task context.

Processing location: United States and other provider regions

DPA or privacy terms: Provider terms

AI processing

OpenAI

Feature-based

Purpose: AI processing when enabled by selected product features or voice providers.

Data: User-provided prompts or call-related AI context when applicable.

Processing location: United States and other provider regions

DPA or privacy terms: Provider terms

Voice calls

Vapi

Feature-based

Purpose: Outbound AI call orchestration for Action Agent.

Data: Call instructions, target language, live call events, transcripts, and call status.

Processing location: United States and other provider regions

DPA or privacy terms: Provider terms

Voice synthesis

ElevenLabs

Feature-based

Purpose: Voice synthesis for AI call experiences when configured.

Data: Text to be spoken by the AI assistant.

Processing location: European Union, United States, and other provider regions

DPA or privacy terms: Provider terms

Telephony

Twilio

Feature-based

Purpose: Telephony infrastructure, SMS, and phone number routing.

Data: Phone numbers, call metadata, webhook events, and delivery status.

Processing location: Global carrier and provider regions

DPA or privacy terms: Provider terms

Payments

Stripe

Feature-based

Purpose: Subscriptions, checkout, invoices, and customer billing portal.

Data: Billing identity, payment status, subscription metadata, invoice records, and transaction references.

Processing location: European Union, United States, and other provider regions

DPA or privacy terms: Provider terms

Email delivery

Resend

Core service

Purpose: Transactional email such as verification, password reset, billing, and security notices.

Data: Email address, message subject, message body, delivery metadata, and bounce or complaint status.

Processing location: United States and other provider regions

DPA or privacy terms: Provider terms

Database

Neon

Core service

Purpose: Managed PostgreSQL database hosting.

Data: Application database records including account, agent, subscription, and user-created data.

Processing location: European Union, Frankfurt region

DPA or privacy terms: Provider terms

Hosting

DigitalOcean

Core service

Purpose: Application hosting and server infrastructure.

Data: Application traffic, operational logs, hosted backend/frontend runtime data, and server metadata.

Processing location: European Union and selected provider regions

DPA or privacy terms: Provider terms

File storage

Cloudflare R2

Core service

Purpose: Object storage for uploaded files and generated document assets.

Data: Uploaded files, generated file assets, object keys, and storage metadata.

Processing location: European Union and selected Cloudflare regions where configured

DPA or privacy terms: Provider terms

Error monitoring

Sentry

Core service

Purpose: Error monitoring, crash diagnostics, and performance issue investigation.

Data: Error stack traces, browser and server diagnostics, route metadata, and limited user/account identifiers for debugging.

Processing location: European Union, Frankfurt region

DPA or privacy terms: Provider terms

Analytics

Microsoft Clarity

Feature-based

Purpose: Optional product analytics and session diagnostics after consent.

Data: Masked product interaction data, browser metadata, and technical diagnostics.

Processing location: European Union, United States, and other provider regions

DPA or privacy terms: Provider terms

Analytics

PostHog

Feature-based

Purpose: Product analytics if enabled for the deployment.

Data: Product events, feature usage, device metadata, and technical diagnostics.

Processing location: European Union where EU Cloud is configured

DPA or privacy terms: Provider terms