Pre-approved Sub-processors
DPA Annex B — Doc2iXBRL (Ontos B.V.)
Last updated: June 2026
Supabase, Inc.
Database, authentication, file storage
- Location
- EU (AWS eu-central-1, Frankfurt)
Fly.io, Inc.
Backend application hosting
- Location
- EU (Amsterdam, NL)
Vercel, Inc.
Frontend hosting, serverless rendering, and content delivery
- Location
- EU (fra1, Frankfurt) for serverless functions; global edge CDN for static assets
OpenRouter, Inc.
AI model routing and API proxy for the AI processing steps (extraction, taxonomy mapping, validation, in-app assistants, bookkeeping interpretation)
- Location
- EU data region for customer-content inference (region-pinned via OpenRouter's EU endpoint); US company, transfers under EU Standard Contractual Clauses
Mistral AI SAS
EU-based OCR and text extraction from uploaded documents. Zero-Data-Retention is enabled and API data is not used for model training.
- Location
- European Union
Amazon Web Services EMEA SARL
Key Management Service (KMS) for envelope encryption of source documents; AWS processes only encrypted data keys and key metadata, never document plaintext
- Location
- EU (eu-north-1, Stockholm)
Functional Software, Inc. (d/b/a Sentry)
Application error tracking, performance monitoring, and session replay; document content is not sent (PII off, payloads scrubbed, replays masked)
- Location
- EU (Frankfurt) data region; US company, transfers under EU Standard Contractual Clauses
The Provider will notify the Customer of any changes to this list in accordance with Clause 4.2 of the Data Processing Agreement.
Get notified automatically whenever this list changes. Add the feed to any RSS reader.
Change history
- Mistral AI OCR processing updatedMistral AI SAS (France) provides EU-based OCR processing for uploaded documents with Zero-Data-Retention enabled. API data is not used for model training, and OCR processing remains EU-to-EU with no third-country transfer.
- Mistral AI addedMistral AI SAS (France) was added as a pre-approved sub-processor for EU-based OCR processing of uploaded documents. Zero-Data-Retention is requested, and API data is not used for model training.
- Sentry addedSentry (Functional Software, Inc.) was added as a sub-processor for application error tracking and performance monitoring. Document content is not sent: PII is disabled, payloads are scrubbed, and session replays are masked. Data is held in the EU (Frankfurt) region under EU Standard Contractual Clauses.
- Amazon Web Services (AWS KMS) addedAmazon Web Services (AWS Key Management Service) was added as a sub-processor for envelope encryption of source documents. AWS processes only encrypted data keys and key metadata, never document plaintext.
- Google LLC removedGoogle LLC was removed from the sub-processor list.
- Sub-processor list publishedThe list of pre-approved sub-processors was published as Annex B of the Data Processing Agreement.
Ontos B.V.