Sub-processors

We use the companies below to run OneBooks. We give at least 30 days’ notice before we add or replace any of them, so you can object first. This page is generated from the register the product actually uses, so it cannot quietly fall behind.

Neon

Hosts the PostgreSQL database in which all customer records are stored.

Processes in: European Union (eu-central-1)
Used since: 2025-01-01
Data they can reach: Every category of personal data in the service
Account details, accounting records, contacts, attachments metadata
Transfers outside the EEA: None required for the primary store — data stays in the EU. Neon is additionally certified under the EU–US Data Privacy Framework.

Cloudflare

Runs the application, the APIs and the public sites, and provides the network and DDoS protection in front of them.

Processes in: Global edge network; US-headquartered
Used since: 2025-01-01
Data they can reach: Data in transit for every request
IP addresses and request metadata
Uploaded files held in object storage
Transfers outside the EEA: Standard Contractual Clauses, in Cloudflare’s customer Data Processing Addendum.

Stripe

Takes subscription payments and issues receipts.

Processes in: United States and Ireland
Used since: 2025-01-01
Data they can reach: Billing name and email
Billing country and currency
Payment and subscription status
Transfers outside the EEA: Certified under the EU–US Data Privacy Framework, its UK extension and the Swiss–US DPF. Card details never reach our systems.

Resend

Delivers transactional email: verification, password resets, and the invoices and quotes a customer chooses to send.

Processes in: United States
Used since: 2025-01-01
Data they can reach: Recipient email address
Message subject and body, including any attached document
Transfers outside the EEA: ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — confirm and file Resend’s DPA and transfer mechanism.

Google public website and signup screens

Measures public website visits and completed app signups with analytics consent; attributes signups to Google Ads only with separate ad measurement consent.

Processes in: United States
Used since: 2025-01-01
Data they can reach: Pseudonymous analytics identifier
Public pages viewed
Signup method
Ad click identifiers with consent
Approximate location from IP
Transfers outside the EEA: EU–US Data Privacy Framework. Consent Mode v2: analytics and ad measurement follow separate choices; ad personalisation is always denied. No names, email addresses or accounting data are sent.

Anthropic

Provides the AI model that writes the assistant’s answers, in chat and in voice calls, when it is enabled as a model provider.

Processes in: United States
Used since: 2026-10-17
Data they can reach: The question the user types, or the transcript of what they say
Accounting data the assistant reads to answer it, and any image the user attaches (such as a scanned receipt)
The assistant’s replies
Transfers outside the EEA: ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — confirm Anthropic’s transfer mechanism, sign and file its DPA, and record the Art. 35 DPIA for the assistant.

ElevenLabs

Runs voice calls with the AI assistant in the mobile app: turns the user’s speech into text and the assistant’s answers into speech.

Processes in: The data-residency region of our ElevenLabs account; United States by default. The service calls the global endpoint api.elevenlabs.io.
Used since: 2026-10-17
Data they can reach: The user’s voice during a call
Transcripts of the call
The assistant’s spoken answers, which can include figures from the accounting data
Transfers outside the EEA: ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — confirm ElevenLabs’ transfer mechanism and sign and file its DPA.

⟨TO BE COMPLETED BY THE CONTROLLER⟩ — other AI model providers

Answers questions the AI assistant is asked, using the accounting data retrieved to answer them.

Processes in: ⟨TO BE COMPLETED BY THE CONTROLLER⟩
Used since: 2026-09-01
Data they can reach: The question the user types
Accounting data retrieved to answer it
Transfers outside the EEA: ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — name every provider enabled in AI_PROVIDER_ORDER besides Anthropic (the order used when it is unset is OpenAI, Cloudflare Workers AI, Google Gemini), confirm each one’s transfer mechanism, and record the Art. 35 DPIA. The assistant is available on every tier, including Free, so this is not an edge case.

Who is not on this list

Customers ask about these, so here is the reasoning rather than silence.

Shopify, Square, Clover, Lightspeed, Loyverse — A sub-processor is one WE engage to process on your behalf. You connect your own POS account and the data flows to us from it. They are a source of your data, not a processor we chose.
ZATCA and other tax authorities — A recipient under your own legal obligation to file, not a processor acting on our instructions.
Our logging and monitoring — Self-hosted on infrastructure we operate. No third party receives the data, so there is nothing to disclose or object to.