Subprocessors
Every third party that can touch data on our behalf, and what it does.
Version 1.1 In force since Sep 02, 2026 Updated Oct 15, 2026
We keep the list short on purpose: each name is one more party with access. Each is bound by a written contract with obligations no weaker than those in our Data Processing Addendum.
| Subprocessor | What it does | Data it can reach |
|---|---|---|
| Hetzner Online GmbH | Hosting of the server, database, queue, object storage and backups (Germany (Falkenstein and Nuremberg)) | Everything the product stores; the certificate is additionally encrypted by us with keys the provider does not hold |
| Quathos Mailer | Email delivery: invitations to join an organisation and contact-form messages | Recipient email, the message, and for contact messages the sender’s name, email, IP address and user agent |
| Quathos Account | Identity hub: sign-in and organisation membership (when enabled) | Name, email, account and organisation identifiers |
Public bodies (independent controllers)
- Sefin Nacional / ADN (Brazilian national NFS-e system): receives the signed XML for issuers on the national standard, such as Rio de Janeiro, and the cancellation events; when you ask for it, we also read your past invoices from the ADN.
- ISS Fortaleza (municipal system): receives the signed RPS batch for issuers registered in Fortaleza (integration in homologation).