Sub-processors
Last updated: 7 October 2026
This is the list of sub-processors referred to in clause 6 of our Data Processing Agreement, and it is the same text as Annex III of that agreement. Before we add or replace a sub-processor we give at least 30 days’ notice by email to each workspace’s administrator and by updating this page.
| Sub-processor | What it processes | Purpose, duration and retention | Transfer mechanism |
|---|---|---|---|
| Anthropic (contracting entity for UK customers: Anthropic Ireland, Limited, Dublin; processing in the United States) | Every page of every document you upload, photograph or email, and every supplier statement, as images and text; the lines of each document, with the names and types of the accounts and items in your Ledger so that lines can be matched to them; your answers to the business profile questions; and the text of in-app assistant conversations, for users who have the assistant switched on | Reading purchase data from documents, proposing a category for lines no learned rule matches, and answering questions in the assistant, for the duration of the Terms of Service. Under Anthropic's commercial terms, which our account is on, inputs and outputs are deleted within 30 days, except where content is flagged by the provider's automated trust and safety systems, in which case it may be kept up to 2 years and the resulting classification scores up to 7 years. The provider does not train its models on what we send it. We are seeking a zero-data-retention arrangement and a countersigned copy of Anthropic's data processing addendum; until either is in place, Anthropic's standard addendum, incorporated in its commercial terms (addendum effective 24 February 2025), governs and the retention described here applies. Anthropic's own sub-processors are listed at trust.anthropic.com | Anthropic processes the data in the United States. The transfer is made under Anthropic's data processing addendum, which incorporates the Standard Contractual Clauses (Module Three, with us as exporter) and the UK Addendum, and which requires Anthropic to apply equivalent safeguards to its affiliates and sub-processors. Our contracting party is Anthropic Ireland, Limited. Anthropic is not certified under the Data Privacy Framework (checked against the official register 6 August 2026) |
| DigitalOcean (DigitalOcean, LLC, a United States company; the data is held in its London region) | All data at rest: application, managed PostgreSQL database, and object storage holding the encrypted documents; platform runtime logs | Hosting, for the duration of the Terms of Service | Processed in DigitalOcean's UK region (LON1). Some support, backup and platform-security providers are in the United States. Covered by DigitalOcean's active EU-U.S. Data Privacy Framework certification and UK Extension, with the EU Standard Contractual Clauses and UK Addendum in its data processing agreement as the fallback. Stated in full at clause 12.1 |
| Microsoft (Microsoft Limited, Microsoft Campus, Thames Valley Park, Reading RG6 1WG, United Kingdom, from which we buy Microsoft 365; the mailbox tenant is set up in the United Kingdom) | Inbound: emails sent to your workspace's forwarding address ([email protected]) and their attachments, including the sender's address and the message. Outbound: the notices, password resets, approval links and digests we send to your users and approvers | Hosting the mailbox that email forwarding reads through Microsoft Graph, and sending our outbound email (which is not kept in the mailbox), for the duration of the Terms of Service. A processed message is moved to a Processed folder in the mailbox, a refused message to a Held folder, and a message to an address that matches no workspace to an Unrouted folder. A retention policy on the mailbox deletes messages in those folders after 90 days. Deleting a document in the service, or erasing your workspace, does not remove the email it arrived in before then; on request we will delete it sooner | Microsoft's Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum, with Microsoft's Data Privacy Framework certification including the UK Extension where applicable. Exchange Online data for a tenant provisioned in the United Kingdom is stored in Microsoft's UK data centres under Microsoft's published data residency commitments; support and some service operations may take place elsewhere |
| Better Stack (Better Stack, Inc., a Delaware corporation operated from Prague; log and uptime monitoring) | Operational log lines forwarded from our web and worker components: workspace identifiers, the usernames of your users where an action is logged, opaque tokens standing in for supplier names and line descriptions, email domains, error text and request identifiers. Never documents, and never the values the redaction layer replaces | Alerting us when the service, the mailbox reader or a Ledger connection fails, for the duration of the Terms of Service. Retained for three days on the plan in use (checked 12 August 2026) | Logs are stored in the European Union. Better Stack, Inc. is a United States company and some of its sub-processors are in the United States, including Amazon Web Services, Cloudflare and an AI provider (OpenAI, L.L.C.), whose AI features we keep switched off on our account. The transfer is made under the Standard Contractual Clauses together with the UK Addendum set out in Schedule E of Better Stack's data processing agreement (25 February 2025). Its sub-processor list is published with that agreement |
Your Ledger provider is a recipient, not a sub-processor. We transmit your data to Intuit or to Xero on your instruction, into a QuickBooks Online company or a Xero organisation that you hold in your own name under your own agreement with that provider. We do not engage either to process data on our behalf.
Intuit's developer terms state that an application developer does not process User Data on Intuit's behalf, and we are required to tell you so; Intuit is not our sub-processor. As between you and us, everything we read from or write to your Ledger is Customer Personal Data that we process as your processor under this DPA. Xero's developer terms do not use controller or processor language; under your own agreement with Xero, Xero is your processor for your organisation's data, and it is not ours.
| Recipient | Location | What it receives | Basis |
|---|---|---|---|
| Intuit (Intuit Limited, London, for UK customers; QuickBooks Online is operated from the United States) | United States | Supplier, line item, VAT and payment data written to your QuickBooks company, and the document attached to it; and the reference data and open items we read back from it | Your instruction, and your own agreement with Intuit for your QuickBooks account. Intuit is certified under the Data Privacy Framework including the UK Extension and its terms also carry the Standard Contractual Clauses and the UK Addendum |
| Xero (Xero Limited, New Zealand, operates the developer platform; Xero (UK) Limited, Milton Keynes, company number 06071722, is Xero's UK entity; Xero hosts its service outside the United Kingdom) | Outside the United Kingdom, as stated in Xero's own privacy notice and data processing terms | Supplier, line item and VAT data written to your Xero organisation as bills and credit notes, the document attached to it, a new contact where a supplier is not already there, and the reference data and organisation settings we read back from it. Payments and statement features are not available on a Xero organisation today | Your instruction, and your own agreement with Xero, under which Xero's data processing terms (carrying the UK Addendum) apply between you and Xero |
Sage. We do not offer a Sage connection to customers today. If we do, Sage will be added to this table as a recipient under clause 6 before any customer connects it.
We disclose Intuit and Xero here notwithstanding the classification, because a list of every company your data reaches is more useful to you than a list that is technically exact and quietly incomplete. Clause 7.3 and the Retention section of our Privacy Policy explain the consequence that matters: records written into your Ledger are outside our reach, including for erasure.
Not sub-processors. Individuals and companies engaged by Scanalyse Limited to provide support or development services are not sub-processors of Customer Personal Data unless they process it, and where they do they are bound by clause 4 and are within the scope of clause 6.4.