Brex Subprocessors List (November 2026): Changes and History
Brex names 25 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Brex subprocessors (November 2026)
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | Anthropic | AI model provider | USA |
| 2 | Amazon | Cloud data hosting and infrastructure provider | USA |
| 3 | Amplitude | Data analytics tool for user behavior | USA |
| 4 | Airwallex | Payments partner for global reimbursement | USA |
| 5 | dLocal | Payments partner for global reimbursement | Brazil |
| 6 | Extend | Invoice extractions | USA |
| 7 | Google Cloud | service and AI model provider | USA |
| 8 | Mastercard | For processing payments made via a Brex MasterCard | USA |
| 9 | MaestroQA | Quality management solution | USA |
| 10 | Merge API | HRIS integration connector | USA |
| 11 | OpenAI | AI model provider | USA |
| 12 | Outreach | Sales engagement platform | USA |
| 13 | Photon Commerce | Invoice extractions | USA |
| 14 | Qualified | Marketing analytics | USA |
| 15 | Quiq | Conversational platform | USA |
| 16 | Transcend | Privacy compliance platform | USA |
| 17 | Salesforce | CRM platform | USA |
| 18 | Scale AI | Invoice extractions | USA |
| 19 | Sierra | AI chat used for customer support | USA |
| 20 | Snowflake | Data and engineering infrastructure | USA |
| 21 | Spotnana | Travel partner | USA |
| 22 | Sunlight | Card information transmitter | USA |
| 23 | Twilio | Messaging application | USA |
| 24 | Wise | Partner for global reimbursements | USA |
| 25 | Zoom | Conferencing tool | USA |
Get an email when Brex changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at Brex
What Brex's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Within 72 hours
“Brex will notify you without undue delay and in any event within seventy-two (72) hours.”
DPA, www.brex.com ↗ - Transfers outside the EU
-
Standard contractual clauses
“such transfer shall be subject to the Standard Contractual Clauses, which are incorporated into and form an integral part of this DPA”
DPA, www.brex.com ↗ - Customer data after the contract ends
-
Deleted within 30 days of the contract ending
“Brex will, upon your written request, delete all Personal Data from Brex's systems and, if requested, certify in writing of its completion within 30 days of such request.”
DPA, www.brex.com ↗ - Audit rights
-
Once a year
“provided that you shall not exercise this right more than once per year.”
DPA, www.brex.com ↗
Certifications at Brex
What Brex's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?
- SOC 2 Type II
-
Active
“In addition to being SOC 1 Type II, SOC 2 Type II, and PCI-DSS compliant”
Trust page, www.brex.com ↗ - PCI DSS
-
Active
“In addition to being SOC 1 Type II, SOC 2 Type II, and PCI-DSS compliant”
Trust page, www.brex.com ↗
Documents we track for Brex
- DPA
- checked November 3, 2026 www.brex.com ↗
- Privacy policy
- checked November 3, 2026 www.brex.com ↗
- Subprocessor list
- checked November 2, 2026 trust-portal.brex.com ↗
- Trust page
- checked November 2, 2026 changed October 16, 2026 www.brex.com ↗
Change history
-
Certification changed
Brex now lists PCI DSS on its trust page.
-
Certification changed
Brex now lists SOC 2 Type II on its trust page.
Tracking since October 15, 2026. Every change links to the two versions of the document it came from. All vendors' changes →
Brex subprocessors FAQ
- How many subprocessors does Brex use?
- Brex lists 25 subprocessors on its published list, including Anthropic, Amazon, Amplitude, Airwallex, and dLocal and 20 more.
- Where does Brex process customer data?
- The subprocessors named by Brex are located in USA and Brazil, as stated on its list.
- How quickly does Brex report a personal data breach to customers?
- According to its DPA, Brex reports a personal data breach to customers within 72 hours: “Brex will notify you without undue delay and in any event within seventy-two (72) hours.”
- How does Brex transfer personal data outside the EU?
- Brex's DPA relies on standard contractual clauses: “such transfer shall be subject to the Standard Contractual Clauses, which are incorporated into and form an integral part of this DPA”
- Does Brex have a SOC 2 Type II report?
- Yes. Brex's trust page lists a SOC 2 Type II report: “In addition to being SOC 1 Type II, SOC 2 Type II, and PCI-DSS compliant”
- Which security certifications does Brex list?
- Brex's trust page lists SOC 2 Type II and PCI DSS.
- When was Brex's subprocessor list last checked?
- ClauseTrail last checked Brex's subprocessor list on November 2, 2026. Lists are re-checked daily.
- How do I find out when Brex adds or removes a subprocessor?
- ClauseTrail monitors Brex's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.