Breeze RMM — Sub-Processor List
Effective Date: April 8, 2026
Last Updated: October 13, 2026
Change notice, October 13, 2026:
- Added to this list: Huntress Labs, Inc. Its security agent has run on Breeze’s production servers since September 24, 2026 and should have been listed then.
- New Sub-Processor: Backblaze, Inc. will store a second, encrypted copy of Breeze’s database backups outside DigitalOcean. It will not store any Customer Data before November 12, 2026, thirty (30) days after this notice.
Customers who wish to object may do so under the process below within thirty (30) days of this notice.
Change notice, October 6, 2026:
- Added to this list: Sentry, Resend and Twilio. They support error tracking, transactional email and SMS respectively. They were already in use before this update and should have been listed earlier.
- New Sub-Processor: Vercel, Inc. will provide isolated, temporary compute for AI analysis workspaces. It will not process Customer Data before November 5, 2026, thirty (30) days after this notice.
Customers who wish to object may do so under the process below within thirty (30) days of this notice.
This page lists the Sub-Processors that Lantern Ops, LLC (“Breeze,” “we,” “us”) engages to process Customer Data and Personal Data in connection with the Breeze RMM platform. This list is maintained pursuant to Section 9.6 of the Terms of Service and Section 7.2 of the Data Processing Addendum.
Current Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| DigitalOcean, LLC | Cloud infrastructure — compute, storage, and networking for the Breeze RMM platform, including managed databases, application servers, object storage, and encrypted backups | Customer Data, device telemetry, user account data, and all data stored within the platform | United States (US Region tenant) and Frankfurt, Germany — DigitalOcean FRA1 (EU Region tenant). See Regional Hosting below. |
| Cloudflare, Inc. | CDN, DDoS protection, DNS, Web Application Firewall (WAF), and mTLS certificate management | Network traffic metadata, IP addresses, request headers; mTLS certificates for enrolled devices | Global edge network (US-headquartered) |
| Anthropic, PBC | AI model provider (Claude) powering AI-assisted device management, diagnostics, and chat features within the platform | Device metadata, system information, diagnostic data, and user queries submitted to AI features | United States |
| GitHub, Inc. (Microsoft) | Source code hosting, CI/CD pipeline (GitHub Actions), and container image registry (GHCR) for building and deploying platform releases | Deployment artifacts and container images; GitHub does not process Customer Data directly | United States |
| Stripe, Inc. | Payment processing, subscription billing, and tax calculation for Breeze RMM subscriptions | Customer billing contact (name, email, address), payment method metadata (card brand, last 4, expiry), and transaction history. Does not process Customer Data collected from Managed Devices. | United States (with global regions) |
| Functional Software, Inc. (Sentry) | Application error tracking and performance monitoring for the hosted platform, in separate US and EU environments | Error events and stack traces with request context, which may include user identifiers and IP addresses; no device telemetry or Customer Data payloads are sent intentionally | United States |
| Resend, Inc. | Transactional email delivery: account notifications, alerts, invitations, password resets, ticket and portal messages | Recipient names and email addresses and the content of notification emails | United States |
| Twilio, Inc. | SMS delivery for multi-factor authentication codes and SMS alerts, where a Partner enables SMS | Phone numbers and one-time codes or alert text | United States |
| Huntress Labs, Inc. | Managed detection and response (endpoint security agent) on Breeze production servers and workforce devices | Security telemetry from those hosts, such as process, file, network and login events; files suspected to be malicious may be collected for analysis, which could incidentally include Customer Data present on the host | United States |
| Backblaze, Inc. (from November 12, 2026) | Off-provider storage of a second copy of database backups, protected against deletion for a fixed retention period | Database backups, encrypted by Breeze before upload; Backblaze does not hold the decryption keys | Amsterdam, Netherlands (EU Region tenant); United States (US Region tenant). Backblaze is a US company. |
| Vercel, Inc. (from November 5, 2026) | Isolated, temporary compute (sandboxed virtual machines with no network access, deleted after each task) for AI analysis workspaces, where a Partner uses AI analysis features | Customer Data that is exported to a workspace for analysis, such as event logs, inventories, custom fields, AI tool results and device files staged for analysis | Frankfurt, Germany (EU Region tenant); Washington, D.C., United States (US Region tenant). Vercel is a US company. |
Changes to This List
In accordance with our Terms of Service (Section 9.6) and DPA (Section 7.3), Breeze will notify Customers at least thirty (30) days before engaging a new Sub-Processor or replacing an existing Sub-Processor.
How to Subscribe to Sub-Processor Change Notifications
To receive advance notice of Sub-Processor changes, contact us at [email protected] with the subject line “Sub-Processor Notifications” and include your organization name and account email. Notifications will be sent to the account owner email address on file or through the Platform’s notification system.
Objection Process
If you have a data-protection-related objection to a new Sub-Processor, you may notify us in writing within thirty (30) days of receiving the change notification. We will work with you in good faith to resolve the concern. If no resolution is reached within thirty (30) days, you may terminate the affected services without penalty, as described in the Terms of Service and DPA.
Regional Hosting
Breeze operates two independent tenants of the Platform on DigitalOcean infrastructure:
- US Region (us.2breeze.app) — primary Customer Data stored in DigitalOcean datacenters in the United States.
- EU Region (eu.2breeze.app) — primary Customer Data stored in DigitalOcean’s Frankfurt, Germany datacenter (FRA1).
Customers select their region at account creation. The two tenants are fully isolated at the infrastructure and data layers, and Customer Data is not replicated between them. Anthropic (AI features), Stripe (payments), GitHub (deployment infrastructure), Sentry (error tracking), Resend (email), Twilio (SMS) and Huntress (security monitoring) remain US-based for both regions; Cloudflare serves both tenants from its global edge network. See our Data Processing Addendum (Section 8.5) for a full description of regional hosting and residual cross-border processing.
Infrastructure Note
Breeze RMM’s databases (PostgreSQL) run on DigitalOcean Managed Databases in each region, and the caching layer (Redis) is self-hosted on DigitalOcean infrastructure. Both are provided by DigitalOcean, listed above, and not by separate Sub-Processors.
Lantern Ops, LLC — a Colorado limited liability company
breezermm.com | [email protected]