Last updated: 1 September 2026
Sub-processors
We try to run a tight stack. The vendors below are the only ones that ever see customer data, and they're all bound to the same standards you hold us to. We notify you in-app and by email at least 14 days before adding or replacing any of them.
- Railway Corp.
Compute, Postgres, Redis and object storage
- Region
- EU
- Certifications
- SOC 2 Type II, GDPR DPA
- Cloudflare, Inc.
Edge network, DNS, WAF and encrypted off-site backups (R2, Western Europe)
- Region
- EU · Western Europe (edge worldwide)
- Certifications
- ISO 27001, SOC 2 Type II, EU Cloud CoC
- Stripe
Billing and payment processing (web subscriptions)
- Region
- EU · Ireland
- Certifications
- PCI DSS Level 1, SOC 1 & 2, ISO 27001
- Apple Inc.
Distribution of the iOS app (App Store, TestFlight), in-app subscriptions with Apple as merchant of record, and push notification delivery (APNs). Sees the purchase and the device and app identifiers, never your financial data
- Region
- US · with EU SCCs
- Certifications
- ISO 27001, ISO 27018
- Google LLC
Distribution of the Android app (Google Play), in-app subscriptions through Play Billing with Google as merchant of record, and push notification delivery (Firebase Cloud Messaging). Sees the purchase and the device and app identifiers, never your financial data
- Region
- US · with EU SCCs
- Certifications
- ISO 27001, SOC 2 Type II
- RevenueCat, Inc.
Subscription management for the native apps: receives the store receipts, purchase events and your vokse account id to resolve entitlements, never your financial data
- Region
- US · with EU SCCs
- Certifications
- SOC 2 Type II
- Plaid Inc.
Bank connections and account information for US and Canadian institutions
- Region
- US · with EU SCCs
- Certifications
- ISO 27001, SOC 2 Type II
- Enable Banking Oy
PSD2 account information for European institutions (licensed AISP)
- Region
- EU · Finland
- Certifications
- PSD2 AISP licence (FIN-FSA), ISO 27001
- Anthropic
Claude inference as the fallback provider for the assistant and for reading receipt photos
- Region
- US · with EU SCCs
- Certifications
- SOC 2 Type II, ISO 42001 alignment
- OpenAI
GPT models for assistant replies, voice-note transcription and parsing, receipt reading, insights, and the similarity vectors behind category suggestions and search
- Region
- US · with EU SCCs
- Certifications
- SOC 2 Type II, ISO 27001
- Resend
Transactional email delivery
- Region
- EU · Germany
- Certifications
- SOC 2 Type II
- Sentry
Error monitoring (PII scrubbed before send)
- Region
- EU · Germany
- Certifications
- ISO 27001, SOC 2 Type II
- Plausible
Cookieless aggregate analytics
- Region
- EU · Germany
- Certifications
- Cookieless · no personal data
| Processor | Purpose | Region | Certifications |
|---|---|---|---|
| Railway Corp. | Compute, Postgres, Redis and object storage | EU | SOC 2 Type II, GDPR DPA |
| Cloudflare, Inc. | Edge network, DNS, WAF and encrypted off-site backups (R2, Western Europe) | EU · Western Europe (edge worldwide) | ISO 27001, SOC 2 Type II, EU Cloud CoC |
| Stripe | Billing and payment processing (web subscriptions) | EU · Ireland | PCI DSS Level 1, SOC 1 & 2, ISO 27001 |
| Apple Inc. | Distribution of the iOS app (App Store, TestFlight), in-app subscriptions with Apple as merchant of record, and push notification delivery (APNs). Sees the purchase and the device and app identifiers, never your financial data | US · with EU SCCs | ISO 27001, ISO 27018 |
| Google LLC | Distribution of the Android app (Google Play), in-app subscriptions through Play Billing with Google as merchant of record, and push notification delivery (Firebase Cloud Messaging). Sees the purchase and the device and app identifiers, never your financial data | US · with EU SCCs | ISO 27001, SOC 2 Type II |
| RevenueCat, Inc. | Subscription management for the native apps: receives the store receipts, purchase events and your vokse account id to resolve entitlements, never your financial data | US · with EU SCCs | SOC 2 Type II |
| Plaid Inc. | Bank connections and account information for US and Canadian institutions | US · with EU SCCs | ISO 27001, SOC 2 Type II |
| Enable Banking Oy | PSD2 account information for European institutions (licensed AISP) | EU · Finland | PSD2 AISP licence (FIN-FSA), ISO 27001 |
| Anthropic | Claude inference as the fallback provider for the assistant and for reading receipt photos | US · with EU SCCs | SOC 2 Type II, ISO 42001 alignment |
| OpenAI | GPT models for assistant replies, voice-note transcription and parsing, receipt reading, insights, and the similarity vectors behind category suggestions and search | US · with EU SCCs | SOC 2 Type II, ISO 27001 |
| Resend | Transactional email delivery | EU · Germany | SOC 2 Type II |
| Sentry | Error monitoring (PII scrubbed before send) | EU · Germany | ISO 27001, SOC 2 Type II |
| Plausible | Cookieless aggregate analytics | EU · Germany | Cookieless · no personal data |
Have a concern? Email dpo@vokse.ai before the 14-day window closes and we'll work with you. If we can't accommodate, you can terminate with a prorated refund.