BenchKey — Subprocessors
Last updated: July 4, 2026 · Version: 2026-07-04
BenchKey (operated by MDrepairs, LLC) engages the third‑party subprocessors below to help provide the Service. Each is bound by contractual data‑protection obligations consistent with our Data Processing Addendum. We update this page at least 30 days before a new subprocessor begins processing Customer Personal Data (DPA §7.3). To receive change notifications by email, write to support@benchkey.com with the subject "Subscribe: subprocessor updates."
Core infrastructure (used to operate the Service)
| Subprocessor | Purpose | Personal data processed | Location | Legal |
|---|---|---|---|---|
| Render (Render Services, Inc.) | Cloud hosting: application + PostgreSQL databases | Account data and Customer Data at rest/in use | United States | render.com/privacy |
| Cloudflare (Cloudflare, Inc.) | Object/file storage (R2) for attachments, uploads, and exports | Files and attachments within Customer Data | United States (global network) | cloudflare.com/privacypolicy |
| Clerk (Clerk, Inc.) | User authentication / identity | Authorized User identifiers and authentication metadata | United States | clerk.com/legal/privacy |
| Stripe (Stripe, Inc.) | BenchKey's own subscription billing (charging shops) | Billing contact and payment metadata (card data is held by Stripe, not us) | United States | stripe.com/legal |
| Resend (Resend, Inc.) | Transactional and shop email delivery | Recipient email addresses, message content | United States | resend.com/legal/privacy-policy |
| Amazon Web Services (Amazon Web Services, Inc.) | Email delivery (SES) | Recipient email addresses, message content | United States | aws.amazon.com/privacy |
| Google (Google LLC — Firebase) | Push notifications; legacy sign‑in | Device/notification identifiers; legacy auth identifiers | United States | policies.google.com/privacy |
AI features (engaged when AI features are used)
| Subprocessor | Purpose | Personal data processed | Location | Legal |
|---|---|---|---|---|
| Anthropic (Anthropic, PBC) | AI‑assisted features (setup, categorization, summaries, drafting) | Only the data submitted to an AI feature, to generate its output | United States | anthropic.com/legal |
| OpenAI (OpenAI, LLC) | AI‑assisted features (per configuration) | Only the data submitted to an AI feature, to generate its output | United States | openai.com/policies |
| Google (Google LLC — Gemini API) | AI‑assisted features (per configuration) | Only the data submitted to an AI feature, to generate its output | United States | policies.google.com/privacy |
Our AI providers process inputs only to return the requested output; we do not permit them to use Customer Data to train models. If a shop connects its own AI provider API key, that provider processes at the shop's direction under the shop's own agreement with the provider.
Customer‑enabled (engaged only when a shop connects or enables the feature)
| Subprocessor | Purpose | Personal data processed | Location | Legal |
|---|---|---|---|---|
| Stripe (Stripe, Inc. — Connect/Terminal) | End Customer payments, if the shop connects Stripe | End Customer payment metadata | United States | stripe.com/legal |
| Square (Block, Inc.) | End Customer payments | End Customer payment metadata | United States | squareup.com/legal |
| Affirm (Affirm, Inc.) | Buy‑now‑pay‑later for End Customer payments | End Customer payment metadata | United States | affirm.com/terms |
| PayPal (PayPal, Inc.) | End Customer payments | End Customer payment metadata | United States | paypal.com/legalhub |
| RingCentral (RingCentral, Inc.) | SMS/MMS/voice messaging | Phone numbers, message and call content | United States | ringcentral.com/legal |
| Twilio (Twilio Inc.) | SMS/voice messaging | Phone numbers, message and call content | United States | twilio.com/legal/privacy |
| OpenPhone (OpenPhone Technologies, Inc.) | SMS/voice messaging | Phone numbers, message and call content | United States | openphone.com/privacy |
| Shippo (Shippo, Inc.) | Shipping labels & tracking for mail‑in repairs | End Customer name, address, phone, email; tracking events | United States | goshippo.com/privacy |
| UPS (United Parcel Service, Inc.) | Shipping labels & tracking (direct carrier integration) | End Customer name, address, phone, email; tracking events | United States | ups.com privacy notice |
| PrintNode (PrintNode) | Cloud printing of receipts/labels | Print job contents (may include End Customer details) | United States / United Kingdom | printnode.com/privacy |
| Intuit (Intuit Inc. — QuickBooks Online) | Accounting sync | Customer, invoice, and payment records the shop syncs | United States | intuit.com/privacy |
| Xero (Xero Limited) | Accounting sync | Customer, invoice, and payment records the shop syncs | United States / global | xero.com/legal |
| Shopify (Shopify Inc.) | E‑commerce / inventory sync | Product and order data the shop syncs | United States / Canada | shopify.com/legal |
Connecting a customer‑enabled provider is at the shop's direction; for that data flow the shop and the provider may act as independent controllers under the provider's own terms. Questions about this page: support@benchkey.com.