StratumBase Subprocessor List
Berlin AI Solutions (BAIS), the operator of StratumBase, uses the following third-party subprocessors to deliver the Service. We maintain this list publicly; we will provide 30 days' written notice (via the email on your Order Form and/or via this subprocessors page) before adding a new subprocessor that materially affects how Customer Data is processed.
Active subprocessors
| Vendor | Service | Data type processed | Location | BAA |
|---|---|---|---|---|
| Railway | Application + database hosting | All customer data at rest + in transit | US (Railway's US region) | Available on request (Enterprise plan) |
| RunPod | vLLM inference (background worker) | Document text during inference (transient) | US (HIPAA-eligible regions on request) | Available on request |
| Sentry | Error monitoring + incidental request data in stack traces | Operational telemetry (may include incidental Customer Data fragments in error contexts) | US | Available on request (Business plan) |
| Stripe | Payment processing | Billing data only (cards, invoices); NO Customer Data / Documents / Queries | US + EU | N/A — no PHI flows |
| Cloudflare | DNS, email routing, CDN | Inbound email forwarding (hello@stratumbase.ai and aliases); DNS |
Global edge | N/A — email forwarding only |
Explicit non-subprocessors
StratumBase does not send Customer Data to the following providers, even though their services exist in the broader technology stack:
- OpenAI, Anthropic, Google AI, or any third-party LLM provider. All AI inference runs on self-hosted models (Ollama for chat, vLLM for ingestion). No customer document content, query text, or chat history is sent to external AI providers.
- Any analytics provider (Google Analytics, Mixpanel, Segment, etc.). No customer activity tracking is shipped off-platform.
- Any training data marketplace. Customer Data is never used to train, fine-tune, or improve any AI model.
Change notification
Material subprocessor changes (additions or relocations to a new jurisdiction) are announced at least 30 days before they take effect. Customers may object to a new subprocessor by written notice; if the objection cannot be resolved, Customer may terminate the affected Subscription Term without penalty (per §14 of the Beta Customer Agreement). For minor changes (a subprocessor's own infrastructure providers, sub-subprocessors, or operational adjustments that don't change data type or jurisdiction), no notice is required.
HIPAA & Business Associate Agreements
StratumBase is architected to support HIPAA-covered customers. For customers handling Protected Health Information, BAIS executes Business Associate Agreements (BAAs) with Railway, RunPod, and Sentry before any PHI is ingested. The BAA chain is currently inactive (no health-covered customers in beta); it will be activated upon execution of the first customer BAA. Contact legal@stratumbase.ai to begin the process.