Subprocessor List
The vendors we use to deliver the Service, and the data each one receives.
Effective October 25, 2026 · Last updated October 25, 2026
About this list
A “subprocessor” is a third party we engage to process Customer Data on our behalf to provide the Service. We engage each subprocessor under a written contract requiring at least the data protection commitments we owe you under our Privacy Policy and Data Processing Addendum.
We publish a new subprocessor on this page at least 30 days before it starts processing personal data, and we email account holders where we can. We send that email by hand; there is no mailing list and no scheduled job behind it, so check this page rather than relying on the email arriving. If you have an active DPA with us and object to the addition, you may terminate the affected portion of the Service for a pro-rated refund.
Questions about this list, or about a change to it: legal@chartofaccounts.ai.
Active subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Stripe, Inc. Stripe SCCs / DPA | Payment processing, billing, customer portal |
| United States |
| Supabase, Inc. Supabase DPA / SCCs | Authentication and application database (PostgreSQL) hosting |
| United States (AWS us-east-1) |
| Vercel Inc. Vercel DPA / SCCs | Application hosting, edge delivery, server logs, and Vercel Web Analytics page-view measurement |
Vercel Web Analytics runs on every page of the site once a visitor clicks Accept on the cookie banner, and not before. The analytics package we embed sets no cookie in your browser. | United States |
| Anthropic, PBC Anthropic Commercial Terms / Zero-Retention API | AI inference for chart-of-accounts analysis and optimization |
Anthropic does not retain or train on data submitted via the commercial API. | United States |
| Intuit Inc. (QuickBooks Online) Intuit Developer Terms | Source data integration via QuickBooks Online OAuth 2.0 |
QuickBooks offers a single accounting permission, which covers both reading and writing; it has no read-only option. We use it only to read your chart of accounts and company information, and we never create, change or delete anything in your company file. | United States |
| Resend, Inc. Resend DPA / SCCs | Transactional email delivery (receipts, password resets, alerts) |
Active when RESEND_API_KEY is configured; otherwise email delivery is disabled and no data is sent. | United States |
| Functional Software, Inc. (Sentry) Sentry DPA / SCCs | Error monitoring, exception tracking, and performance telemetry for the Service |
Session Replay is disabled. We do not attach user identifiers to error reports. We do not intentionally send Customer Data; if it appears in an exception payload it is treated as transient diagnostic data. | United States |
| Upstash, Inc. Upstash DPA / SCCs | Background job queue (QStash) and the shared lock store that keeps one job from running twice (Redis) |
Queued job payloads carry internal record ids plus the settings the job runs under — which prompt variant to use, whether the account is in demo mode, the operation type and its credit cost. They carry no account names, no balances and no chart of accounts. The processing region is set in the Upstash console and is not recorded in this codebase, so we do not assert one here. | Not confirmed |
| Cloudflare, Inc. Cloudflare DPA / SCCs | The “Verify you are human” box (Cloudflare Turnstile) on the sign-up, sign-in and password reset pages. It tells a person from an automated program, so we can stop fake sign-ups and password guessing. |
Only on those three pages, and only while the box is switched on. Until then no Cloudflare script loads and nothing is sent to Cloudflare. When you submit the form, Supabase, our sign-in provider, sends Cloudflare the box’s single-use token and your IP address to check it. Cloudflare also uses these signals to improve its bot detection, as its own data controller under its Turnstile Privacy Addendum. | Cloudflare data center nearest you; stored mainly in the United States and the European Economic Area |
Affiliates
We may also engage our own affiliates and personnel to process Customer Data, subject to confidentiality obligations no less protective than this list and our DPA.
Questions
Subprocessor questions or DPA execution requests: legal@chartofaccounts.ai.