Draft — pending legal review
Subprocessor List
ainventry — a product of Andrei Diachenko (autónomo), Spain. Last updated: 28 June 2026.
DRAFT — for legal review only.
We use the subprocessors listed below to provide the ainventry service. All subprocessors are contractually bound via Data Processing Agreements (DPAs) or equivalent mechanisms to process personal data only as instructed by ainventry and to implement appropriate technical and organisational security measures.
We will update this list and provide at least 30 days' advance notice of any new subprocessor that materially affects how personal data is processed. You may object to the addition of a new subprocessor by contacting us at andreidiachenko95@gmail.com.
Core Infrastructure Subprocessors
| Subprocessor | Parent Company | Purpose | Data Processed | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Railway | Railway Corp | Backend application hosting, PostgreSQL database, Celery/Redis task queue | All Customer Data and account data at rest | United States | Standard Contractual Clauses (SCCs) |
| Cloudflare Pages | Cloudflare, Inc. | Frontend hosting, CDN delivery, DDoS protection, TLS termination | IP addresses, HTTP request metadata (no Customer Data stored) | Global (US + EEA edge nodes) | SCCs; Cloudflare Privacy Shield successor mechanisms |
Communication Subprocessors
| Subprocessor | Parent Company | Purpose | Data Processed | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Resend | Resend, Inc. | Transactional email (account verification, password reset, notifications) | Email addresses; email content (non-business data only) | United States | SCCs |
AI / Machine Learning Subprocessors
| Subprocessor | Parent Company | Purpose | Data Processed | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Anthropic | Anthropic, PBC | AI assistant large language model inference | Natural-language commands; relevant Workspace context included in the prompt | United States | Standard Contractual Clauses (SCCs) |
Conditional Subprocessors (only when you activate the integration)
| Subprocessor | Parent Company | Purpose | Data Processed | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Intuit Inc. (QuickBooks Online) | Intuit Inc. | Accounting data synchronisation — activated only when you connect your QuickBooks Online account | QuickBooks OAuth tokens (encrypted at rest), company realmId (encrypted at rest), customer/vendor/item data per OAuth scope | United States | Intuit acts as a separate data controller for your QuickBooks data; ainventry → Intuit transfer is governed by Intuit's own terms and ainventry Developer Agreement |
Payment Processor
| Subprocessor | Parent Company | Purpose | Data Processed | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Stripe Payments Europe, Ltd. | Stripe, Inc. | Payment processing / billing | Billing name, email address, card metadata (full card numbers are not stored by ainventry or Stripe Payments Europe — tokenised via Stripe) | Ireland (EU); onward transfer to Stripe, Inc. (United States) for processing | SCCs (EU–US onward transfer governed by Stripe's SCC-based DPA) |
Notes
- Intuit: We list Intuit as a conditional subprocessor for completeness. Technically, when you push data to QuickBooks Online, Intuit becomes a separate data controller for that data under Intuit's own privacy policy.
- No AI training: ainventry does not use Customer Data to train AI models, and our agreement with Anthropic prohibits use of API inputs for model training purposes. This is consistent with Anthropic's current API usage policy (API inputs are not used to train models by default).
- No advertising: We do not share personal data with advertising networks, data brokers, or social media platforms for advertising purposes.
- Transfer impact assessments: We maintain internal Transfer Impact Assessments (TIAs) for all US-based subprocessors as required by GDPR Chapter V.
Change History
| Date | Change | Notice sent |
|---|---|---|
| 28 June 2026 | Initial list published; Stripe added as payment processor | — |