Last updated: 2026-07-29
PureBox uses the third-party service providers listed below (sub-processors) to deliver the service. Each sub-processor processes customer data only as necessary for the stated purpose.
OpenAI is our current AI classification sub-processor and receives limited Gmail-derived metadata (such as sender, subject, and label signals) to classify messages. PureBox does not offer a HIPAA Business Associate Agreement, and mailboxes used for regulated healthcare work are outside the scope of the Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google (Gmail API) | Email access and classification | United States |
| Supabase | Database and authentication | United States (AWS us-east-1) |
| Azure (Microsoft) | Application hosting | United States |
| Stripe | Payment processing | United States |
| OpenAI | Email classification AI | United States |
| GitHub (Microsoft) | Private source repository and automated tooling used to prepare classification accuracy test cases; receives de-identified samples only, never raw mailbox content | United States |
| Better Stack | Logging, monitoring, and session replays (session replays may capture on-screen Gmail-derived metadata as rendered in the app; application logs are field-redacted) | European Union |
| PostHog | Product analytics, session recording, and in-product surveys (consent-gated; session recordings may capture on-screen Gmail-derived metadata such as subjects, senders, snippets, and classification results as rendered in the app; form-field inputs are masked) | United States |
| Google Analytics | Website and audience analytics (consent-gated; no Gmail content) | United States |
| MailerLite | Optional marketing email delivery (opt-in only; account email + first name) | European Union / United States |
We may update this list from time to time as our service evolves. The current sub-processors are always shown above. If you have questions about any sub-processor, contact support@purebox.ai for assistance.