Subprocessor List
Subprocessor List
Under GDPR and other data protection laws, we're required to be transparent about the third-party services (sub-processors) that process data on our behalf. This page lists every sub-processor we use, what they do, and where they're located.
Current sub-processors
Some of the services below are engaged only when you use the feature they support — bank feed aggregators only if you enable the bank feed add-on, managed backup storage only if you opt in to it, transactional email only once you receive email from us. Where a row is marked "add-on" or "opt-in", no data reaches that sub-processor unless you turn the feature on.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe | Payment processing (license purchases and invoice payments) | Cardholder data, transaction amounts, billing addresses | United States |
| PayPal | Invoice payment processing | Transaction amounts, payer email, billing addresses | United States |
| Square | Invoice payment processing | Transaction amounts, cardholder data, billing addresses | United States |
| Plaid | Bank feed aggregation (add-on) | Bank credentials (direct from user, not through us), account metadata, transaction data (dates, amounts, payee names, categories) | United States |
| Yodlee (Envestnet) | Bank feed aggregation (add-on, backup provider) | Bank credentials (direct from user, not through us), account metadata, transaction data | United States |
| Plausible Analytics | Privacy-focused website analytics | Aggregate page views only (no personal data — listed for transparency) | European Union (Germany) |
| OVH | Hosts our single production server — website, license server, payment endpoints, and bank feed process all run on one virtual private server we administer ourselves | License activation data, machine identifiers, invoice and payment-status data, customer contact info | United States |
| Hetzner | Encrypted off-site copy of that server's nightly backups (Storage Box) | Whatever the server itself holds, as an encrypted nightly archive | Germany |
| Backblaze B2 | Managed cloud backup storage (add-on) | Client-side-encrypted backup data only — content-addressed encrypted chunks and manifests (zero-knowledge; B2 and Solid Accounting hold ciphertext that cannot be read) | United States (EU-region storage available for EU customers) |
| Postmark | Transactional email delivery (primary) | Email addresses, invoice notification content | United States |
| SendGrid | Transactional email delivery (standby provider — not currently engaged; disclosed in advance so we can fail over without a 30-day wait) | Email addresses, email content | United States |
| Sentry | Error tracking for our server-side services (not currently engaged; disclosed in advance) | Error logs, stack traces (no financial data) | United States |
| Modal | GPU compute for training AI adapters (engaged only when customers opt in to Training Contribution) | Anonymized tokenized correction pairs (no customer PII) | United States |
| Cloudflare | CDN for software installer downloads and AI adapter distribution | Installer binaries and signed adapter bundles (no personal data) | Global (US primary) |
| Anthropic | Internal-only — our engineering team uses Claude for annotation-template drafting. No customer data is sent to Anthropic. | No customer data | United States |
Payment providers as independent controllers
Stripe, PayPal, and Square are listed above as sub-processors for the data processing we instruct them to perform on your behalf (processing payments on your invoices). However, these payment providers also process personal data as independent data controllers for their own purposes — including fraud prevention, regulatory compliance (anti-money laundering, sanctions screening), and their own service improvement. That processing is governed by each provider's own privacy policy, not by this list or our Data Processing Agreement. See: Stripe Privacy Policy, PayPal Privacy Statement, Square Privacy Notice.
Bank feed aggregators as independent controllers
Plaid and Yodlee are listed above as sub-processors for the bank feed data they retrieve on your behalf. However, these aggregators also act as independent data controllers for certain processing activities — including fraud prevention, identity verification, and their own product improvement. When you connect your bank account through their widget, you agree to their terms directly. That processing is governed by each provider's own privacy policy: Plaid Privacy Policy, Yodlee Privacy Notice.
Solid Accounting never receives your bank login credentials. Those are provided directly to the aggregator through their secure, hosted authentication widget.
Cloud backup storage
Backblaze B2 is our sub-processor only for the managed cloud backup option. Because backups are end-to-end encrypted on your device before upload, B2 stores ciphertext it cannot read.
If you instead choose to send backups to your own folder (including a cloud-synced folder such as Dropbox, iCloud, OneDrive, or Google Drive) or to your own S3-compatible storage credentials, that provider is engaged by you, not by us — it is not our sub-processor, and its handling of your (still-encrypted) data is governed by your agreement with them.
Change notification
We'll email you at least 30 days before adding a new sub-processor or materially changing the purpose of an existing one. The notification will include:
- The name and location of the new sub-processor
- What data they'll process and why
- The effective date of the change
Your right to object
If you object to a new sub-processor, you have 30 days from the notification date to raise your objection by emailing privacy@solidaccounting.com.
We will not begin sharing your data with the new sub-processor until the 30-day notice period has elapsed. We'll work with you in good faith to find a resolution. If we can't resolve your objection within 30 days, you may terminate the affected service (the invoicing portal) without penalty. Your desktop software license is not affected.
Our obligations
For each sub-processor listed above, we:
- Have a Data Processing Agreement (or equivalent contractual protections) in place
- Require them to implement security measures at least as protective as those described in our Security Practices
- Require breach notification to us within 72 hours
- Conduct periodic reviews of their security and compliance posture
- Remain fully liable to you for each sub-processor's performance of its data protection obligations
International data transfers
For sub-processors located outside the EU/EEA, we rely on Standard Contractual Clauses (European Commission Decision 2021/914) as the legal mechanism for cross-border data transfers. You can request copies of executed SCCs by emailing privacy@solidaccounting.com.
Plausible Analytics processes data exclusively within the EU, so no cross-border transfer mechanism is required for website analytics data.
Subscribe to updates
To receive notifications when this list changes, email privacy@solidaccounting.com with the subject line: "Subscribe: Subprocessor Updates"
We'll add you to our notification list and email you before any changes take effect.