Sub-processors
Last updated: 2026-09-20 · Version 2026.09
Sub-processor List
As of version 2026.09. Pursuant to section 6 of the Data Processing Agreement, your authorisation is deemed granted for the following service providers. We announce changes at least 30 calendar days in advance in the application; you may object.
| Provider | Seat | Purpose of processing | Categories of data | Third-country safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Falkenstein, Deutschland (EU) | Hosting and operation (server, database, file storage) | all data processed on your behalf | EU |
| OpenAI, L.L.C. | USA | AI features (consent-gated only): receipt recognition, assistant, evaluations | content you feed into AI features | EU-US Data Privacy Framework |
| OpenRouter | USA | Alternative AI gateway, if configured | content you feed into AI features | Standard Contractual Clauses |
| Cloudflare, Inc. | USA | Bot protection (Turnstile) on public forms | technical request data (IP, timestamp) | EU-US Data Privacy Framework |
| Lunch Flow | lunchflow.app | Banking integration (account/transaction retrieval via PSD2) | balances, transactions, access tokens | EU |
Note for self-hosted installations: the hosting row is replaced by the service providers actually engaged by the operator.