Subprocessors
These are the companies that process data for us to run Cifrova, each under a data processing agreement. None of them may use the data for their own purposes.
| Provider | Role | Location | What they receive |
|---|---|---|---|
| Fintable | Bank account aggregation (open banking, PSD2) | Portugal / EU | Account names, IBANs, balances, movements, under the consent you give Fintable |
| OVH | Hosting of the application and the database | France (EU) | Everything the Service holds, encrypted at rest |
| Cloudflare | DNS, TLS termination, protection against attacks | EU points of presence; global network | Connection metadata (IP address, request headers) |
| Anthropic | AI: category proposals, summaries, the Advisor | United States (SCCs, Data Privacy Framework) | Movement lines, category names, budget and net worth summaries, Advisor questions; not used for training |
| Brevo (Sendinblue) | Transactional email: sign-in links, digests, reminders | France (EU) | Email address, name, the content of the emails |
| Stripe | Payments, invoices, VAT | Ireland (EU) and United States (SCCs) | Email, name, billing address, payment details (which we never see) |
| CoinGecko, Yahoo Finance | Prices of crypto and listed assets | Global | Ticker symbols only; no personal data |
Households that bring their own Anthropic key in Settings send AI data under their own agreement with Anthropic instead of ours.