Last updated: 2026-08-21
We use the third-party providers below to deliver the service. We engage each under written terms with data-protection obligations equivalent to our own, and we remain responsible for their processing. We give at least 30 days' notice of additions or changes (see the DPA); to be notified, email privacy@fin-central.com.
Several rows are conditional: the service integrates with them only when the corresponding feature is configured, and with no key configured no data reaches that provider at all. The hosting and monitoring entries are set by the operator of this instance, because they are properties of the deployment rather than of the software; npm run check:legal --strict refuses to build a release while either is unstated.
| Subprocessor | Purpose | Location | When used |
|---|---|---|---|
| OVHcloud (OVH SAS) | Application & server hosting | United Kingdom (London) | Always |
| PostgreSQL, run inside this deployment | Primary data storage | Same as hosting, above | Always |
| Resend (Resend, Inc.) | Transactional email — sign-in, password reset, weekly digest | US | Only when an email API key is configured; with none set the app sends no email |
| Stripe Payments Europe | Subscription billing & card processing | EU / UK | Only if billing is enabled |
| Xero, Intuit (QuickBooks), Sage | Accounting data sync via your OAuth consent | UK / EU / US | Only if you connect that system |
| TrueLayer | Open-banking data (bank feeds) | UK / EU | Only if you connect Open Banking |
| OpenRouter, Anthropic or OpenAI — whichever the operator has configured | Generating AI commentary & copilot answers | US, under the UK IDTA / SCCs | Only if AI features are enabled; with no key configured the assistant answers from the ledger alone and nothing is sent |
| Amazon Web Services (S3) or Cloudflare (R2) | Uploaded evidence & attachment storage | Operator-selected region | Only if the file-storage driver is set to S3/R2; the default keeps files in the database above |
| Amazon Web Services (KMS) or Google Cloud KMS | Envelope encryption of connector credentials | Operator-selected region | Only if managed KMS is configured; the default uses a local key |
| SerpAPI (SerpApi, LLC) | Identifying the vendor behind an unrecognised bank-transaction description, for the recurring-payments and supplier features | US, under the UK IDTA / SCCs | Only if SERPAPI_API_KEY is set. With no key set, no search request is made and the feature falls back to a local dictionary |
| Microsoft (Bing Search API) | Same purpose as the row above; the alternative search engine | US, under the UK IDTA / SCCs | Only if BING_SEARCH_API_KEY is set and no SerpAPI key is. With no key set, nothing is sent |
| None | Error/uptime monitoring and website analytics | Same as hosting, above unless stated otherwise | If enabled by the operator |
Accounting connectors and AI providers only receive the data necessary for the feature you enable. AI features can be turned off per organisation, in which case no data is sent to an AI provider.
On the search engines, precisely. When vendor enrichment is enabled, what leaves this deployment is the normalised description text of a bank transaction — for example ADOBE * 800 LICENSE 4071 — sent as a search query so the vendor behind it can be named. That text can contain a counterparty's name. It is sent with no account number, no amount, no date, no other transaction field and nothing identifying you or your organisation. If a key is set for one of these engines and AI features are also enabled, the top few search results are then passed to the AI provider named above to extract the vendor name. Enrichment is off unless the operator sets a search key; those two environment variables are the only switch, and with neither set the feature uses a built-in dictionary and makes no outbound request.
The database is not a separate third-party subprocessor: PostgreSQL runs as part of this deployment, on the hosting provider named in the first row.
On monitoring and analytics, precisely. The application bundles no error-reporting or product-analytics library — there is no Sentry, Datadog, Bugsnag, Rollbar, LogRocket, PostHog, Segment or similar dependency, and no such code runs. It does include one optional, off-by-default loader for a privacy-first website analytics script (Plausible, or Google Analytics 4 as an alternative). That loader emits nothing at all unless the operator sets NEXT_PUBLIC_PLAUSIBLE_DOMAIN or NEXT_PUBLIC_GA_ID; with neither set, no third-party script is requested and no browser of yours contacts anyone but this deployment. If the operator has enabled it, the provider is named in the monitoring row above — npm run check:legal --strict refuses to release a build that claims "None" while an analytics key is configured.