Subprocessors
Every third party that processes data on our behalf, what it does, and what it receives. This list is generated from the deployment's configuration so it cannot drift from reality.
Last reviewed 2026-09-02. Changes are announced 14 days in advance on the changelog.
Current subprocessors
| Provider | Role | What it receives |
|---|---|---|
| Hosting provider (not yet declared for this deployment) | Application hosting, database, object storage and processing | All service data, including uploaded statements for the retention period, encrypted in transit and stored in private storage |
| Stripe | Payments, invoicing and subscription management | Name, email, billing address, payment details (entered directly with Stripe), plan and invoice data. Never receives statements. |
Explicitly not used
- Third-party OCR services: recognition of scanned pages runs on our own infrastructure with Tesseract.
- AI providers: the optional AI column-mapping step is disabled in this deployment, so no AI provider receives any content.
- Email delivery providers: transactional email is not sent through a third party in this deployment.
- Advertising or data brokers: none.