Legal
Subprocessors
Every third party that can process your data on our behalf, what it does, and where it sits. This list is complete — if it changes, this page changes.
Last updated July 30, 2026
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting, CDN, aggregate page analytics, private file storage (Vercel Blob), and AI request routing (AI Gateway) | All request traffic; technical logs; files you upload — receipts, attachments, statements, and import files — stored encrypted in a private store. AI requests pass through the gateway and are deleted immediately after each request completes — nothing is retained | United States |
| Neon | Managed PostgreSQL database and encrypted backups | Your account details and all bookkeeping data | United States |
| Resend | Transactional email delivery | Your email address and the contents of sign-in codes and invitations | United States |
| Stripe | Payment processing and subscription management | Your name, email, billing address and card details, collected directly by Stripe | United States |
| Anthropic | AI document reading — only when you use it: extracting a receipt into a draft transaction, or reading a bank statement's dates and balances during reconciliation | The document you ask it to read, plus the account and payee names needed to match it; sent per request under zero-data-retention terms — deleted once the request completes, never stored, never used to train models | United States |
| Amazon Web Services (Bedrock) | Backup serving infrastructure for the same AI document reading — used only when Anthropic's own service can't take the request | The same per-request document, under the same zero-data-retention terms — deleted once the request completes, never stored, never used to train models | United States |
| Google Cloud (Vertex AI) | Backup serving infrastructure for the same AI document reading — used only when Anthropic's own service can't take the request | The same per-request document, under the same zero-data-retention terms — deleted once the request completes, never stored, never used to train models | United States |
What isn’t on this list
There is no advertising network, no session-replay or heatmap tool, and no customer-data platform. No service on this list trains models on your data. The AI features are opt-in per use — nothing from your ledger is sent to an AI provider unless you click the button that says so. Every AI request is made under zero-data-retention terms, enforced on each request: the document is deleted by the provider once the request completes, and a request that can’t be served under those terms fails rather than falling back to a provider that would keep it. AWS and Google Cloud appear on this list only because they can serve the same Anthropic models when Anthropic’s own service is at capacity — under the same terms.
Changes
If we add a subprocessor that will process customer personal data, we will update this page before it goes live and email account owners at least 30 days beforehand, so you have time to object or to leave with your data. See the Privacy Policy for how to reach us.