Business Friendly, Inc. uses the service providers below to operate the BusinessFriendly.ai platform (the Business Friendly Index). This list reflects what our production code actually sends to each provider today. See our Security & Trust page and Privacy Policy for more context.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers), database (D1), file storage (R2), and hosted Whisper speech-to-text (Workers AI) for voice notes | All application data in transit and at rest; voice-note audio sent for transcription only, never stored by the transcription step itself |
| Anthropic, PBC | Claude models: Ally's answers, note/document analysis, report narrative generation, comment analysis, action-plan drafting | The specific business, survey, or document content needed to answer the request in front of Ally at that moment |
| Stripe, Inc. | Payment processing (purchases and subscriptions) | Payment details; Business Friendly does not receive or store full card numbers or CVV |
| Resend | Transactional email (invitations, reminders, receipts, staff notifications) | Recipient email addresses and message content |
| Twilio Inc. | Text messages between Business Friendly staff and prospective or current customers who agreed to receive texts | Phone numbers and message content |
| OpenStreetMap Foundation (Nominatim) | Address-to-coordinate lookup for the business map | Business street addresses submitted for geocoding |
| Geocod.io (Loki Labs LLC) | Paid address-to-coordinate lookup for the business map when an organization's map needs it | Business street addresses submitted for geocoding |
| Microsoft Graph (Microsoft Corporation) | Optional customer-connected Microsoft 365 calendar (create/view/link events) | Calendar events only — the connection never requests mail access |
| 8x8, Inc. (JaaS / Jitsi as a Service) | Video meetings, including virtual business visits; cloud recording and transcription when the organizer turns recording on | Meeting audio/video and participant names for meetings that are scheduled on the platform |
Ally's spoken voice uses one of the following, in this priority order depending on which is configured; only the narration text is sent, never business records.
| Provider | Purpose | Data involved |
|---|---|---|
| Cartesia, Inc. | Text-to-speech voice synthesis (primary) | Narration/response text converted to audio; audio is cached by text hash so identical lines are not resent |
| ElevenLabs, Inc. | Text-to-speech voice synthesis (fallback) | Narration/response text converted to audio |
| OpenAI, L.L.C. | Text-to-speech voice synthesis (fallback) | Narration/response text converted to audio |
| Provider | Purpose | Data involved |
|---|---|---|
| U.S. Census Bureau (api.census.gov) | Community/economic aggregate statistics (Census, ACS, Business Patterns) | None of ours — we only send a geography/table query and receive public aggregate data back |
| U.S. Bureau of Labor Statistics (api.bls.gov) | Labor market aggregate statistics (QCEW and related series) | None of ours — we only send a series/geography query and receive public aggregate data back |
| Provider | Purpose | Data involved |
|---|---|---|
| Google Analytics / Google Ads | Website traffic and advertising-performance measurement on our public marketing pages only | Browsing and conversion data via the gtag tag; not used inside the signed-in product |
This list will change as we add or remove providers. Where a Data Processing Addendum with a customer commits to advance notice of subprocessor changes, we follow that commitment for that customer.