Back to the Data Processing Agreement

Pre-approved Sub-processors

Supabase, Inc.

Database, authentication, and file storage. Every table carries row-level security, and sensitive financial fields are encrypted at the application layer before they reach the database.

Location: EU (AWS eu-central-1, Frankfurt)

Vercel, Inc.

Frontend hosting, server-side rendering, and content delivery.

Location: EU (fra1, Frankfurt) for server-side execution; global edge CDN for static assets. US company, transfers under EU Standard Contractual Clauses.

Fly.io, Inc.

Worker machines running the compilation pipeline, including the parsing of XAF audit files and the generation of filing documents.

Location: EU (Amsterdam, NL). US company, transfers under EU Standard Contractual Clauses.

CipherStash Pty Ltd

Key management for the field-level encryption of sensitive financial data (ZeroKMS). CipherStash processes key material and key metadata; it does not receive the plaintext of any field.

Location: EU (eu-central-1, Frankfurt) key region. Australian company, transfers under EU Standard Contractual Clauses.

OpenRouter, Inc.

AI model routing and API gateway for the AI-assisted steps (mapping suggestions, classification, and checks). The platform mints a separate key per user or organisation, so use is attributable, capped, and revocable. The Provider does not permit OpenRouter or any model provider behind it to retain Customer Data for model training, as Clause 2.8 of the Data Processing Agreement provides.

Location: EU data region for inference on customer content: the platform is configured to call OpenRouter's EU endpoint. US company, transfers under EU Standard Contractual Clauses.

Mistral AI SAS

Document text recognition (OCR) for scanned source documents in the compilation pipeline, such as prior-year filings supplied as scans. The Provider does not permit Mistral AI to retain Customer Data for model training, as Clause 2.8 of the Data Processing Agreement provides.

Location: EU regional inference with zero data retention, both required when the service is provisioned. French company; transfers outside the EU, where they occur, take place under EU Standard Contractual Clauses.

Functional Software, Inc. (d/b/a Sentry)

Application error tracking and performance tracing. Client financial data is not sent: personally identifying data is off, local variables are never captured, and session replay is compiled out of the application. User-submitted feedback is the one deliberate exception, because it carries the words the user chose to write.

Location: Sentry's EU data region. US company, transfers under EU Standard Contractual Clauses.

Google Ireland Limited

Two distinct roles. First, business email and the relay for transactional mail (Google Workspace), which carries correspondence with the Customer and notifications addressed to Users. Second, website measurement and advertising measurement (Google Tag Manager, Google Analytics, Google Ads) on the public pages only, loaded solely after the visitor grants the matching cookie consent and never inside the application.

Location: EU (Ireland), with Google's own regional storage commitments.

The Provider will notify the Customer of any changes to this list in accordance with Clause 4.2 of the Data Processing Agreement.

Subscribe to changes

This feed is the notification mechanism of Clause 4.2. Add it to any feed reader and every addition, removal, or change to the list above arrives without you having to check this page.

Sub-processor change feed

Change history

Sub-processor list published

The list of pre-approved sub-processors was published as Annex B of the OntosCompile Data Processing Agreement: Supabase, Vercel, Fly.io, CipherStash, OpenRouter, Mistral AI, Sentry and Google. All processing of client financial data takes place in EU regions.

In force since: August 9, 2026