Sub-processors
These are all providers that process personal data on our behalf. The list is complete and applies as of the date given below. It is part of the Data Processing Agreement.
This language is translated automatically. The legally reviewed versions are under wavor.co.uk and wavor.de.
Learn moreCDN, DNS, DDoS protection, bot detection (Turnstile), cookieless reach measurement (Web Analytics)
SOC 2, ISO 27001
Payment processing, subscriptions, identity verification
PCI DSS Level 1
Email sending and receiving (SES), short-term storage of inbound emails (S3, Frankfurt)
ISO 27001, SOC 2
Object storage for uploaded customer files (receipts, documents, images)
ISO 27001, stored in Germany. Encryption at rest by the provider (AES-256).
Offsite backups: database dumps (encrypted with our own key before transfer) and a mirror copy of customer files
SOC 2. Bucket with Object Lock (compliance mode): once written, a backup cannot be deleted before its retention date.
AI features (chat, text, receipt reading, analysis)
SOC 2 Type II, ISO 27001/27701, data in the EU
AI features when the provider in the EU cannot be reached, and image generation (logo drafts). Inputs are not used to train the AI models (API usage).
SOC 2 Type II, no training on API inputs
Domain registration and management (ICANN/DENIC mandatory WHOIS data)
EU-based (Netherlands)
Transfers outside the EU
Standard Contractual Clauses (SCC) per Art. 46(2)(c) GDPR are in place with all US-based sub-processors. Data Processing Agreements per Art. 28 GDPR are in place with EU-based providers.
When a provider is added
Before we use a new provider, we tell you at least 28 days in advance. If you object within that time on reasonable grounds, we will not use it for your data; if the service cannot be delivered without it, you may terminate as of the effective date and receive a pro-rata refund of amounts paid in advance.
If a provider fails unexpectedly, we may temporarily switch to a substitute where that is necessary to keep the service running or to protect your data. Any such substitute is bound in advance to the same level of protection. In that case we inform you without undue delay after the switch; your right to object is unaffected.
Read on
Data Processing Agreement · Политика конфиденциальности · Безопасность