# Service providers we use

> The companies that help us run Broker & Agent, what each one does, what data it receives, and when it's used.

We share data only with the service providers that help us run our websites and apps, and only for that purpose. We never sell your data. Your data is stored in the United States.

## Who they are

| Provider | What for | What it receives | When |
|---|---|---|---|
| Cloudflare | Hosting, file storage, caches, queues, bot checks and our staff's sign-in | All data the apps handle | Always |
| Neon, on Amazon Web Services | Our databases: one for accounts, Workspace and website leads, and one for our customers' websites themselves | All account and workspace data, and website content and settings | Always |
| Google Firebase | Sign-in accounts | Your name, email, password hash and sign-in events | Always |
| Postmark | Sending and receiving email | Recipient addresses and email content | Always |
| Stripe | Payments and invoices | Your billing name, email and address, and your payment method, which Stripe holds | When you buy |
| OpenAI | The AI features, like the website assistant, search and transcription | What the AI is asked, and the records it's asked about | When AI is used |
| MLS Grid and Spark | Listing data for your website | Nothing; we receive listings from them | With a website plan |
| Google (Search Console, Gmail, Calendar) | Your site's search data, and a mailbox or calendar you connect | What's connected | Only when connected |
| Microsoft | An Outlook mailbox or calendar you connect | What's connected | Only when connected |
| Esri (ArcGIS), OpenStreetMap services and Open-Meteo | Maps, addresses, routes and weather, and the map tiles in a website's home search | Addresses and coordinates, and site visitors' IP addresses, since their browsers load the map tiles | If used, and on every website with a map |
| Google Fonts | Fonts on our customers' websites | Site visitors' IP addresses, since their browsers load the fonts | With a website plan |
| Twilio | Texting and calling | Phone numbers, and message, call and voicemail content | Not in use yet; texting and calling haven't launched |

## About a few of them

- **Payments.** Card details go straight to Stripe, a PCI Level 1 certified provider, and never touch our servers.
- **AI.** OpenAI is the only AI provider in our products. We send requests with storage turned off, and OpenAI doesn't train its models on API data. OpenAI may keep requests for up to 30 days to watch for abuse.
- **Encryption at rest.** The databases, files and caches are encrypted at rest by Neon and Cloudflare.

## On brokerandagent.com

Our own website counts visits with Plausible Analytics and Cloudflare Web Analytics. Both are cookieless and don't identify you. The background video on our home page streams from Pexels, so they see your IP address in that request.

## What isn't on the list

There are no analytics or advertising trackers inside our apps, and no outside error-tracking service: errors stay in our own database.

Questions about how we handle data: [privacy@brokerandagent.com](mailto:privacy@brokerandagent.com).

---

Source: https://brokerandagent.com/help/security/service-providers