SUB-PROCESSORS
Sub-processors
Last updated: May 11, 2026
The processors listed below assist us in delivering the Service. Each is bound by a Data Processing Agreement (DPA) and, where applicable, by Standard Contractual Clauses (SCC) for transfers outside the EEA.
We notify all active customers by email at least 30 days before adding a new sub-processor. You may object by replying to that email; we will work with you on a solution or, if none is possible, refund any prepaid period.
Active sub-processors
| Sub-processor | Role | Data location | Categories of data | Transfer mechanism | Links |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Hosting (Pages, Workers, D1, R2) | EU region (Frankfurt / Amsterdam) + global edge | All uploaded files (1 h max), audit metadata, account data, HTTP logs | EU region selected; SCC for residual transfers | DPA · Privacy |
| Anthropic PBC | LLM (Claude Haiku 4.5) | USA | Anonymized parser samples (headers + 2–3 rows with amounts / names / IBANs / NIPs replaced by placeholders). Full file contents are never sent. | SCC + EU-US Data Privacy Framework | DPA · Privacy |
| Plausible Insights OÜ | Cookieless aggregated analytics | Estonia (EU) | Anonymized hit counters; no PII, no cross-site identifiers | Not applicable — EU only | Data policy |
| Functional Software, Inc. (Sentry) | Application error monitoring | EU region selected | Stack traces, request metadata. File contents are stripped before submission. | EU region selected; SCC for residual transfers | DPA · Privacy |
Why each one
Cloudflare
The Service runs as Cloudflare Pages (static landing) plus Cloudflare Workers (API). Uploaded files live in Cloudflare R2 for at most one hour. Parser configs and account data live in Cloudflare D1 (SQLite, EU region). HTTP logs are kept for 90 days then purged.
Anthropic
When a user uploads a file in a format we have not encountered before, our backend sends an anonymized sample to Anthropic's Claude Haiku 4.5 to produce a structured parser config (JSON describing column mapping, date format, decimal separator). The model receives only column headers and 2–3 sample rows with all sensitive values (amounts, names, IBANs, NIP/VAT IDs) replaced by structural placeholders that preserve type but contain no real data. Once the config is saved, every future user with the same format is served deterministically from cache — no sub-processor call.
Anthropic's DPA contractually prohibits training on customer data.
Plausible
Plausible serves aggregated traffic statistics: page-view counts, top referrers, country-level geography. No cookies, no cross-site identifiers, no PII. As per the European Data Protection Board, cookieless analytics in this configuration do not require user consent.
Sentry
Sentry captures unhandled errors so we can fix them. Our SDK strips uploaded file contents and personal identifiers from all events before transmission. Stack traces and HTTP method/path are retained for 30 days.
Changelog
- 2026-05-11 — Initial publication.
Notifications
To be notified by email about future changes to this list, write to hi@checkunpaidinvoices.com with the subject line "Sub-processor notifications". Active paid subscribers receive these notifications automatically.
Last updated: 2026-05-11.