Primary subprocessors
These vendors are required to deliver the core service. Customer Data is processed by them as part of normal operation.
| Vendor | Activity | Data category | Location |
|---|---|---|---|
| Supabase Inc. | Managed Postgres, authentication, object storage | All Customer Data and account data | EU region — Stockholm, Sweden (eu-north-1). All tenant data is processed here; transfer from KSA relies on the SCC-equivalent clauses in the DPA plus the SDAIA Transfer Regulations. |
| Vercel Inc. | Web application hosting (Next.js), edge serving, static assets | Account data, page-render telemetry; Customer Data passes through during requests but is not persisted | Global edge network; Customer documents are stored only in the EU database/storage |
| Hetzner Online GmbH | Extraction-worker host — polls queued voucher batches and runs the OCR + AI extraction pipeline | Customer Data in flight during extraction; not persisted long-term | Germany (EU) |
| Anthropic PBC | Large-language-model inference for document classification, field extraction, journal-entry proposal, AI Inbox, narrative generation | Document text and extracted fields submitted as model prompts; responses returned for processing | Provider US/EU regions per their API; Customer Data is not used for model training under our agreement |
| Mistral AI SAS | Optical character recognition (OCR) and layout extraction on uploaded PDFs | Page-image submissions; OCR text returned for downstream processing | France (EU) · Customer Data is not used for model training under our agreement |
| Speechmatics Ltd | Speech-to-text transcription for the voice assistant (Growth tier and above; only when voice features are used) | Microphone audio of the user's spoken query; transcript returned for processing | United Kingdom |
| ElevenLabs Inc. | Text-to-speech synthesis and conversational-voice transport for the voice assistant (Growth tier and above; only when voice features are used) | AI assistant reply text submitted for audio synthesis; voice-session audio. No documents. | United States |
| Resend, Inc. | Transactional email delivery (account, billing, trial-end notifications) | Recipient email address, subject and body of transactional emails | EU region |
Secondary subprocessors
These vendors support observability, billing, abuse prevention, operational alerting and product analytics. They do not host or persist Customer documents. Customers can opt out of product analytics for their entire workspace.
| Vendor | Activity | Data category | Location |
|---|---|---|---|
| Sentry GmbH (Functional Software, Inc.) | Error monitoring and performance traces for the application | Error stack traces, request URLs (with PII redaction at source), user ID hash | EU region |
| Better Stack (BetterStack Ltd.) | Application logs aggregation and alerting | Application log lines; Customer Data fields are scrubbed before shipping | EU region |
| PostHog Inc. | Product analytics — pseudonymised event-level usage data (opt-out per workspace) | Pseudonymised user ID, event name, timestamp, page path; no document content, no keystrokes | EU region (EU ingestion endpoint) |
| Cloudflare, Inc. | Bot-challenge verification (Turnstile) on sign-in and public form endpoints | IP address, challenge token, request headers; no Customer Data | Global edge |
| Upstash, Inc. | Serverless Redis used as a shared counter store for API rate limiting and sign-up abuse detection | Rate-limit counters keyed by user ID, hashed IP address or network prefix, and a truncated hash of the sign-up email address; no Customer documents or ledger data | See vendor (the database region is set per deployment) |
| Slack Technologies, LLC (Salesforce, Inc.) | Operational alerting — posts to an internal operations channel when a scheduled job fails or a threshold trips; optionally a period-close summary when a close-pack delivery to Slack is requested | Job names, counts, status and pseudonymised identifiers; for a close-pack delivery, the period and posted-entry totals. No documents, no bank or buyer details | See vendor |
| Twilio Inc. | Operational alerting by WhatsApp message to the operator — used only when this channel is configured in place of Slack | The same operational alert text as above; the recipient is the operator, not a Customer | See vendor |
| Paddle.com Market Ltd. | Merchant of record: subscription billing, payment processing, invoicing and sales-tax/VAT determination and remittance | Billing contact name and email, billing address and country, payment-method metadata (card last-four, brand), tax identifiers, invoice and subscription records | United Kingdom / EU, with card processing via Paddle payment partners |
Customer-authorised integrations
These are the external services a Customer chooses to connect so their books can be built from source data. Each connection is read-only, is made only on the Customer's instruction, and can be revoked by the Customer at the source.
| Vendor | Activity | Data category | Location |
|---|---|---|---|
| Amazon Services LLC (Selling Partner API) | Read-only retrieval of settlement, fee, refund and reserve records (the Finances endpoints) from a connected Amazon seller account, within Amazon's Finance and Accounting role. Connected only when the Customer authorises it; revocable by the Customer in Seller Central | Amazon seller ID, marketplace ID, settlement and financial-event records. No buyer personal data is requested | Amazon regions per marketplace; retrieved records are stored in the EU database (Stockholm) |
| Wise (Wise Payments Limited and Wise group companies) | Read-only retrieval of balance statements from a connected Wise business account, used to reconcile bank deposits against Amazon settlements. Connected only when the Customer provides a Wise API token; revocable by the Customer in Wise | Wise profile and balance identifiers; statement transactions (date, amount, currency, fees, running balance, payment reference and counterparty name where Wise provides it) | See vendor; retrieved statements are stored in the EU database (Stockholm) |
Notification of changes
We notify active Customers of subprocessor additions or replacements at least 30 days in advance, by email to the workspace's billing-contact address and by updating the "Last updated" date on this page. Customers with a Data Processing Addendum in place can object on reasonable grounds; if we cannot accommodate the objection, the Customer may terminate the subscription with respect to the affected service for a pro-rata refund of pre-paid fees.
To request the current Data Processing Addendum or our security questionnaire response pack, contact us via the contact page.