Legal
Authorized Sub-processors
The third-party services authorized to process personal data on behalf of our customers. Last updated: September 2026.
In accordance with our Data Processing Addendum (DPA) and Article 28 of the GDPR, we maintain a current list of all third-party sub-processors that process personal data on behalf of our customers.
What is a sub-processor?
A sub-processor is any third-party entity engaged by THE GROVVEST AI LTD to process personal data on behalf of our customers in connection with the TaxItEasy® Service.
Notification of changes
We announce a new or replaced sub-processor by updating this list, and its change log, before it processes any personal data. You may object on data protection grounds within 14 days of the update (Section 4.3 of our DPA).
CDN & Network Security
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Content Delivery Network (CDN), DDoS protection, Web Application Firewall (WAF), and DNS | IP addresses, HTTP request headers, User-Agent strings, and technical request metadata. Cloudflare does not have access to the content of encrypted payloads or user-uploaded documents. | United States (global edge network) | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
Infrastructure & Hosting
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| DigitalOcean, LLC | Kubernetes cluster (DOKS), managed PostgreSQL database, container registry, networking, in-cluster Redis | All Customer Data (documents, extracted data, account data, audit logs) | Frankfurt, Germany (EU) — FRA1 region | Data residency in EU; DigitalOcean is a US-incorporated company — SCCs apply for any controller-incidental access. Client-side encryption (envelope encryption MEK/UEK/DEK) ensures DigitalOcean never sees plaintext document data. |
AI & Document Processing
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Anthropic, PBC | AI-powered data extraction and OCR via Claude API, called directly from our Celery workers in DOKS Frankfurt over HTTPS. Also generates answers for the public website assistant (chatbot) from visitor-submitted questions. | Document content submitted for processing (invoices, receipts), and messages typed into the public website assistant. Retention follows Anthropic's commercial default (up to 30 days for safety monitoring); contractual zero-retention addendum in negotiation. | United States | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
| Mistral AI SAS | Generates text embeddings of public website-assistant (chatbot) messages and knowledge-base content so the assistant can retrieve relevant help articles, via the Mistral API over HTTPS | Messages typed into the public website assistant. No account, document, banking, or tax data is sent — the assistant is unauthenticated and has no access to Customer Data. | France (EU) | EU provider; we configure processing within the EU. |
Payments
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management, and billing | Billing name, email, payment method details, transaction history | United States (with EU data residency for payment data) | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
Communications
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Resend, Inc. | Outbound transactional + newsletter email delivery (verification, notifications, receipts, newsletter incl. double-opt-in confirmation emails) | Email addresses, names, notification and newsletter content | United States | Standard Contractual Clauses |
| OhMySMTP Ltd (MailPace) | Inbound email receiving (receipt forwarding to your private @in.taxiteasy.org address) | Email metadata (sender, recipient, subject) and message content including attachments, in transit to our systems. MailPace retains received emails for a maximum of 35 days per its DPA; on our side, email bodies are processed and discarded — only extracted attachments are stored. | United Kingdom (company); email data hosted in France (EU), backups in Germany (EU), SMTP relay in the UK | UK adequacy decision (European Commission); primary data hosting within the EU |
Mobile App Services
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Apple Inc. | Delivery of push notifications to iPhones (Apple Push Notification service); confirming at sign-in that the iPhone app is genuine (App Attest) | Push token, a short fixed notification text and internal reference numbers (no amounts, names or document content); App Attest key attestation and assertion data | United States | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications to Android phones | Push token, a short fixed notification text and internal reference numbers (no amounts, names or document content) | United States | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
| 650 Industries, Inc. (Expo) | Delivery of program code updates to the mobile app | Update check of the app: app version, platform, update channel, a random installation identifier and IP address. No account, document, banking or tax data | United States | Standard Contractual Clauses |
Object Storage & Backup
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| DigitalOcean Spaces (LLC) | Encrypted object storage for documents and database backups | Encrypted documents (per-file DEK), encrypted database backups | Frankfurt, Germany (EU) — FRA1 region | EU data residency; DigitalOcean LLC US-incorporated — SCCs apply for controller-incidental access. Document content is encrypted client-side before upload (DigitalOcean never sees plaintext). |
Monitoring & Error Tracking
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring for the web app, and crash and error reporting for the mobile app, with automatic PII scrubbing | Web app: error stack traces, request metadata, browser info, user ID and IP address. Mobile app: crash and error reports with device model, operating system and app version, stack trace and a random installation identifier, without any account reference and without storing the IP address. PII is scrubbed before transmission | United States (company); data stored in Sentry’s EU data region (Germany) | EU-U.S. Data Privacy Framework / Standard Contractual Clauses |
Important notes
- Your documents are never used for AI training. Anthropic's terms of service explicitly exclude commercial API traffic from training data. Retention of API request content follows Anthropic's commercial default (up to 30 days for safety monitoring, after which it is deleted); a contractual zero-retention addendum is in active negotiation between TaxItEasy and Anthropic.
- Payment data is handled by Stripe. We do not store credit card numbers, CVVs, or full payment details on our own systems. All payment processing is handled by Stripe in accordance with PCI DSS standards.
- EU data residency. All primary data storage and processing occurs within the European Union. Transfers to the United States (for AI processing, payment, email, error monitoring, push notifications and app updates) are protected by the transfer mechanisms listed above.
- Application-layer encryption. All sensitive document content and database fields (Tax IDs, IBANs, OCR text) are encrypted at the application layer with envelope encryption (AES-256-GCM, MEK/UEK/DEK hierarchy) before being written to DigitalOcean infrastructure. The hosting provider never sees plaintext data.
- Error monitoring with PII scrubbing. Sentry automatically scrubs personally identifiable information (PII) from error reports before transmission. No document content, invoice data, or user-uploaded files are sent to Sentry. Reports from the mobile app carry no account reference, and our Sentry data is stored in its EU data region.
- Backup encryption. All backups stored on DigitalOcean Spaces are encrypted at rest. Database backups use pg_dump with maximum compression and are encrypted before upload.
- Cloudflare as network proxy. Traffic to the marketing site (taxiteasy.org, www.taxiteasy.org) and to the operator console passes through Cloudflare’s network; the application API (api.taxiteasy.org) and the app itself are served directly from our EU load balancer and do not pass through Cloudflare. Cloudflare processes IP addresses and request metadata for security purposes. It does not have access to your documents, invoice data, or account content. Cloudflare sets two strictly necessary security cookies (
__cf_bm,cf_clearance) for bot detection and DDoS protection.
Change log
| Date | Change |
|---|---|
| September 29, 2026 | Changes are now announced by updating this list before the new sub-processor processes personal data (previously 30 days in advance by email); the 14-day objection right is unchanged |
| September 29, 2026 | Added Apple Inc. (Apple Push Notification service, App Attest), Google LLC (Firebase Cloud Messaging) and 650 Industries, Inc. (Expo, app updates) for the mobile app; expanded the Sentry scope to crash and error reports from the mobile app and recorded its EU data region |
| September 16, 2026 | Narrowed the Cloudflare scope to the names that actually pass through its network (marketing site and operator console); the application API (api.taxiteasy.org) and the app are served directly from our EU load balancer |
| August 12, 2026 | Expanded Resend, Inc. scope from outbound transactional email only to transactional + newsletter email delivery (double-opt-in confirmation and newsletter sends for the new opt-in newsletter) |
| July 2026 | Added OhMySMTP Ltd (MailPace, UK — EU hosting) as sub-processor for inbound email receiving (receipt forwarding to @in.taxiteasy.org); clarified Resend, Inc. scope as outbound transactional email only |
| June 2026 | Added Mistral AI SAS (EU) as sub-processor for the website assistant; expanded Anthropic scope to cover website-assistant answer generation |
| March 2026 | Added Cloudflare, Inc. as CDN & Network Security sub-processor |
| March 2026 | Initial publication |
Questions?
If you have questions about our sub-processors or data processing practices, please contact us at
.
THE GROVVEST AI LTD – Evangelou Floraki 10, Villa 4, 8220 Paphos, Cyprus – HE 478768