Subprocessors
Every third party that processes data on our behalf, what it does, and what it receives. This list is generated from the deployment's configuration so it cannot drift from reality.
Last reviewed 2026-09-02. Changes are announced 14 days in advance on the changelog.
Current subprocessors
| Provider | Role | What it receives |
|---|---|---|
| Hosting provider (not yet declared for this deployment) | Application hosting, database, object storage and processing | All service data, including uploaded statements for the retention period, encrypted in transit and stored in private storage |
| Cloudflare | DNS, TLS termination, proxy and caching in front of every host, and Cloudflare Web Analytics | Request metadata for every page (address, IP address, headers) as the proxy in front of the service, and page-view beacons for its analytics. Uploads pass through it encrypted in transit; it does not store statements. |
| Stripe | Payments, invoicing and subscription management | Name, email, billing address, payment details (entered directly with Stripe), plan and invoice data. Never receives statements. |
| Pageviews.ai | Website and product analytics: where visitors come from and how many people use the app | Page address, referrer, and browser and device metadata on the marketing pages and in the member area. A member-area address can carry a conversion id, which is a random label; it never receives statement contents, transactions, balances, names or account numbers. |
| Anthropic | AI fallback extraction for statements the deterministic engine cannot read or reconcile, and optional column mapping | The text of the statement's pages when the fallback runs: dates, descriptions, amounts, balances and any account details printed on those pages. Every answer is checked against the statement's balances before use. Not used for model training and not retained beyond the request. |
Explicitly not used
- Third-party OCR services: recognition of scanned pages runs on our own infrastructure with Tesseract.
- Email delivery providers: transactional email is not sent through a third party in this deployment.
- Advertising or data brokers: none.