Sub-processors
Version 1.0 Current effective from 7. 10. 2026
Sub-processors
Annex C to the Data Processing Agreement v1.2 · list version 1.0
Status as at: 30 September 2026. Current list: https://reporting.finance/legal/sub-processors.
| Sub-processor | Activity | Data | Location | Transfer safeguards |
|---|---|---|---|---|
| Google Cloud EMEA Limited, Dublin, Ireland (and its affiliates incl. Google LLC, USA) | Cloud infrastructure: Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, Secret Manager, load balancing, logging | All Controller Personal Data | EEA – europe-west3 (Frankfurt); Google support access and network edge may be outside the EEA | Cloud Data Processing Addendum; EU-U.S. DPF (Google LLC certified); standard contractual clauses |
| Plus Five Five, Inc. (Resend), San Francisco, USA | Sending transactional emails (invitations, password resets, acceptance confirmations) | Recipient name and email, email content, delivery logs; no accounting data | Sending from the EU region (where configured); account management and logs in the USA | EU-U.S. DPF (certified); standard contractual clauses in Resend’s DPA |
| Microsoft Ireland Operations Limited, Dublin, Ireland | Support mailbox (Microsoft 365 / Exchange Online) | Content of emails the Controller or Users send to support (including any attachments) | EEA (EU Data Boundary); limited exceptions under Microsoft’s terms | Microsoft Products and Services DPA; EU-U.S. DPF (Microsoft Corporation certified); standard contractual clauses |
Not Sub-processors (no Controller Personal Data): GitHub (source code), domain registrar.
Planned artificial-intelligence features will use models (including Anthropic’s Claude models) provided by Google through Vertex AI with an EU endpoint; processing is governed by the Google Cloud terms above. This new processing activity will start only after notice under Article 7.2 and in accordance with Article 7.5.
The Processor recommends sending accounting data only by uploading it to the Service, not by email.
Differences between the Sub-processors’ standard terms and this Agreement, for which the Processor remains liable to the Controller (Article 7.6): Google Cloud notifies incidents “promptly and without undue delay” (not within 48 hours), provides audits primarily through audit reports, physically erases data up to 180 days after deletion and typically gives 30 days’ notice of sub-processor changes. Resend typically gives 14 days’ notice of sub-processor changes; its primary operations and logs are in the USA, while sending may use an EU region. Microsoft 365: EU Data Boundary with limited exceptions under Microsoft’s terms. The Processor shall verify the DPF list entries (Plus Five Five, Inc.; Google LLC; Microsoft Corporation) before first use and keep a copy.
Versions of this document
| Version | Effective from | Status | |
|---|---|---|---|
| version 1.2, effective from 26. 11. 2026 | 26. 11. 2026 | Upcoming — effective 26. 11. 2026 | |
| version 1.1, effective from 26. 11. 2026 | 26. 11. 2026 | Superseded before taking effect | |
| 1.0 (shown) | 7. 10. 2026 | Current |
Which version applies to a particular client is recorded in that client's acceptance (Settings → Legal documents in the application).