Sub-processors | Softbooq

To deliver Softbooq, we engage a small number of third-party sub-processors. Each is bound by a Data Processing Agreement and may process personal data only on our documented instructions, in line with GDPR Article 28. Your business remains the data controller; Softbooq is the processor.

AI providers

Softbooq AI uses these providers for retrieval and inference only. Your data is never used to train the AI models that answer you. Relevant text is sent with a single request; how long each provider keeps it, and why, is on its card below. Softbooq AI reads the documents you scan, such as receipts and supplier invoices, whenever Softbooq AI is on. It reads your other workspace data only when an administrator turns on Read my business data in Settings > Softbooq AI.

Anthropic Claude (Anthropic PBC)

The Softbooq AI assistant (conversations in both chat tiers, financial and business-intelligence questions, weekly briefings, document summaries and actions inside the platform), reading documents (OCR and data extraction from receipts, invoices, expenses, leases and other uploads), inline writing actions, automation steps and the setup assistant · USA

Your questions and conversation history, summaries of the workspace records relevant to the question (for example invoices, contracts, employee profiles, projects), and the images and text of the documents you submit or ask the assistant to analyse (receipts, invoices, contracts, expense photos, ID documents, business cards, resumes).

What it keeps: Anthropic deletes requests and responses within 30 days. If its automated safety systems flag a request under its Usage Policy, it may keep that request for up to 2 years and the safety scores for up to 7 years, and it keeps data longer where the law requires. It does not use them to train its models without the customer's express permission.

Anthropic Commercial Terms

Google Gemini (Google LLC)

Search embeddings (turning record and document text into search vectors), and a backup model for the fast chat tier, inline writing actions, automation steps, the setup assistant and travel-policy rates, used only when Anthropic does not answer · USA

Record and document text sent for search indexing; and, only when it stands in for Anthropic, the messages and record context of that one request. Document images are not sent to Google.

What it keeps: Google keeps the requests and responses of its paid Gemini API for 55 days, solely to detect and prevent violations of its Prohibited Use Policy and for legally required disclosures; authorised Google staff may review them for that purpose. Google does not use them to improve its products, and trains no model on these logs other than the systems that enforce its policies.

Gemini API Terms

Platform infrastructure

Supabase (Supabase Inc.)

Authentication, database, file storage and serverless functions · AWS eu-central-1, Frankfurt, Germany

All workspace data Softbooq stores on your behalf, stored at rest in the EU.

Stripe (Stripe Payments Europe, Limited)

Subscription billing and payment processing, including Stripe Connect payments; card data is entered with Stripe and never stored on Softbooq servers · USA / EU

Billing contact and payment details.

Brevo (Sendinblue SAS)

Transactional email delivery · EU

The emails Softbooq sends, and those a workspace sends through Softbooq's default sender, including invoices and their attachments; the recipient's name and email address.

Cloudflare (Cloudflare Inc.)

Application hosting and content delivery (Cloudflare Pages and Workers), and storage of encrypted backups (R2) · global edge network; backups in the EU

Request metadata (IP address, request logs) needed to serve the application; and backup copies of the database and of stored files, encrypted before they reach Cloudflare, which cannot read them.

GitHub Actions (GitHub, Inc.)

Running the nightly and weekly backup jobs, which encrypt the copies before they are stored · USA

The database and the stored files, passing through memory for the minutes a backup job takes to encrypt them. Nothing is written to disk unencrypted, and nothing is kept after the job.

International data transfers

Your workspace data is stored at rest in Frankfurt, Germany (AWS eu-central-1). Some sub-processors above (the AI providers, and parts of our platform infrastructure) process data in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and, where the provider participates, the EU-U.S. Data Privacy Framework, together with supplementary measures: encryption in transit, the providers' limited retention set out above, and the contractual exclusion of model training on your inputs.

Integrations you enable

When your administrators connect a third-party integration (an accounting tool, CRM, cloud drive, and so on), that provider becomes an additional sub-processor for the data you choose to sync with it. These are optional and specific to your configuration. Each one, who runs it and what it receives, is listed on the Third-party services page. The full data-flow record for each integration is available on request and referenced in your Data Processing Agreement.

Changes to this list

We keep this page current as our sub-processors change. For questions, or to request notification of changes, contact privacy@softbooq.com. See also our Privacy Policy.