Subprocessors
Every third party that touches customer data, what it receives, and which country it is in.
Version 1.0 · In effect since
A subprocessor is a company we use to run the service that, in doing so, handles data belonging to our customers. This is the complete list. Each is bound by contract to protect the data to a standard comparable to our own and to use it only to provide its service to us.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Primary database, authentication, and document storage | All customer data, including encrypted Social Insurance Numbers and banking details, and every uploaded document | United States |
| Vercel | Application hosting and scheduled jobs | All data in transit through the application; no separate long-term store | United States |
| Resend | Sending and receiving email | Recipient names and addresses, full message content, and any attachment a client emails in | United States |
| Stripe | Subscription billing | Firm billing contact and payment details, client and employee counts. No employee identities and no payroll figures | United States |
| Anthropic | Optional: matching an uploaded bank statement to the account and month it belongs to | Up to the first 4,000 characters of the statement text and the file name. Off unless a firm enables it | United States |
| Sentry | Error monitoring | Error diagnostics and stack traces. Social Insurance Numbers are stripped before transmission and session replays are recorded with all text and input masked | United States |
| Upstash | Optional: rate limiting | Request counters keyed to an identifier. No payroll or personal records | United States |
| Xero | Optional: pushing invoices and payroll journals to a firm’s ledger | Client business name, CRA business number, address and contact, invoices, and payroll journal totals. Connected only when a firm authorises it | New Zealand / United States |
Which of these you can avoid
Four of the eight are optional and are not engaged unless a firm turns them on:
- Anthropic — off by default. See the AI Disclosure.
- Xero — engaged only when a firm connects its own Xero account.
- Upstash — used for rate limiting where configured; the service falls back to its own database otherwise.
- Sentry — receives diagnostics only, and never request bodies, cookies or headers.
Changes to this list
We give at least 30 days’ notice before adding a subprocessor or materially changing what an existing one receives. A firm that objects on reasonable data-protection grounds may raise it with us during that period, and if it cannot be resolved may terminate the affected part of its subscription without penalty, as set out in the Data Processing Addendum.
To be told when this page changes, write to us using the details on the contact page.