vporiadku
Legal DocumentsSubprocessors

Subprocessors

Under GDPR Art. 28(2) we publish the complete list of third parties that process personal data on our behalf. It is generated directly from the application's configuration, so it cannot drift away from reality.

List version: 2026-10-12

We notify you in advance of any change to the roster of subprocessors, and you have the right to object. This list forms part of the data processing agreement.

  • Railway Corp.

    United Statesinfrastructure

    depends on configuration

    Hosting of the application server and the PostgreSQL database, with all customer data at rest.

    Data:
    account data, document content, counterparty data, bank movements, attachments
    Transfer mechanism:
    EU region (europe-west4) with EU Standard Contractual Clauses in the Railway DPA.
    The provider's data-protection terms

  • Vercel Inc.

    United Statesinfrastructure

    transfer outside the EEA

    Hosting and edge delivery of the web application. Sees request metadata, not database content.

    Data:
    IP address, request metadata
    Transfer mechanism:
    EU Standard Contractual Clauses (modules 2 and 3) in the Vercel DPA.
    The provider's data-protection terms

  • OpenAI Ireland Ltd. / OpenAI, L.L.C.

    Irelanddata processingoptional

    transfer outside the EEA

    Optional AI features, only when the user invokes one: creating invoices from text or a voice recording, reading uploaded documents (their text, or page images of a scan or photo), commands, the tax-preparation review and the website chat. Speech-to-text always runs here.

    Data:
    document text, document images, voice recordings, counterparty data, amounts
    Transfer mechanism:
    OpenAI, L.L.C. in the United States processes the data as sub-processor of OpenAI Ireland Ltd., under the EU Standard Contractual Clauses in the OpenAI DPA plus a transfer impact assessment. API data is not used for training and is retained for at most 30 days.
    The provider's data-protection terms

  • Anthropic PBC

    United Statesdata processingoptional

    transfer outside the EEA

    Alternative provider for the same AI features except speech-to-text, used only where the operator has selected it.

    Data:
    document text, document images, counterparty data, amounts
    Transfer mechanism:
    EU Standard Contractual Clauses in the Anthropic commercial terms, plus a transfer impact assessment.
    The provider's data-protection terms

  • Stripe Payments Europe, Ltd.

    Irelanddata processing

    transfer outside the EEA

    Subscription billing for vporiadku itself. Card details go to Stripe directly and never reach our servers.

    Data:
    account data, billing data
    Transfer mechanism:
    EU Standard Contractual Clauses in the Stripe DPA for onward transfers to Stripe, Inc. in the United States.
    The provider's data-protection terms

  • Resend (Plus Five Five, Inc.)

    United Statesdata processing

    transfer outside the EEA

    Delivery of outgoing e-mail: invoices with their PDF attachments, reminders, account notices.

    Data:
    recipient address, document content, attachments
    Transfer mechanism:
    EU Standard Contractual Clauses in the Resend DPA; mail is sent from Resend’s EU region (Ireland). A workspace may configure its own SMTP server, in which case that server is the customer’s own processor and not ours.
    The provider's data-protection terms

  • Financial Administration of the Slovak Republic

    Slovakiapublic authority

    EEA

    Receives VAT returns, control statements and, from 2027, invoice data under the five-corner model.

    Data:
    document content, counterparty data, amounts, tax data
    The authority's website

  • Cloudflare, Inc.

    United Statesinfrastructureoptional

    transfer outside the EEA

    Bot protection on the sign-up form (Turnstile) and, where object storage is enabled, file storage (R2).

    Data:
    IP address, attachments
    Transfer mechanism:
    EU Standard Contractual Clauses in the Cloudflare DPA; R2 buckets are pinned to an EU jurisdiction.
    The provider's data-protection terms

  • Functional Software, Inc. (Sentry)

    United Statesinfrastructureoptional

    transfer outside the EEA

    Error reporting. Stack traces can incidentally contain fragments of the data being processed when the error occurred. Only after the visitor consents to analytics: masked session replays (all text, inputs and media blocked).

    Data:
    error context, masked session replay
    Transfer mechanism:
    EU Standard Contractual Clauses in the Sentry DPA, with the EU ingest endpoint and PII scrubbing enabled.
    The provider's data-protection terms

  • European Commission (VIES)

    European Unionpublic authority

    EEA

    Validation of counterparty VAT identification numbers. Only the VAT number is sent.

    Data:
    VAT identification number
    The authority's website

  • Register of Financial Statements (Ministry of Finance of the Slovak Republic)

    Slovakiapublic authority

    EEA

    Company lookup by IČO in the public Register of Financial Statements. Only the IČO being looked up is sent.

    Data:
    company registration number
    The authority's website

Transfers outside the EEA

For every recipient outside the European Economic Area we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment. We do not rely solely on the EU-US Data Privacy Framework, which is under judicial review.