Last updated: 28 October 2026
Sustifi uses the companies below to run the service. Each processes personal data only to provide the function listed. Our privacy policy explains what we process and why.
Data processing agreements have not yet been confirmed for any provider. Until each agreement and its transfer clause have been checked, the transfer column says "to be confirmed".
| Company | Purpose | Personal data | Region | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | All account and service data | EU (Ireland) | Data stored in the EU; access by the US company: to be confirmed (EU-US Data Privacy Framework or Standard Contractual Clauses) |
| Vercel Inc. | Application hosting, serverless functions, content delivery, cookieless web analytics and Speed Insights | Request data including IP address; all data passing through the application | EU (Ireland); content delivery network: global | To be confirmed (EU-US Data Privacy Framework or Standard Contractual Clauses) |
| Upstash Inc. | Rate limiting (Redis) | IP address, user ID and hashed API key, as short-lived counters | To be confirmed | To be confirmed |
| Company | Purpose | Personal data | Region | Transfer mechanism |
|---|---|---|---|---|
| Anthropic PBC | Claude: reading receipt images, transaction category suggestions, recommendations, bank-statement reading fallback, receipt and product classification, prediction chat, VS and CSRD assistants and narratives, information request mapping | Receipt images (may show the merchant, card digits and names), transaction descriptions and counterparty names, statement text, receipt lines, product names, report content, chat messages, questionnaire text | USA | To be confirmed (EU-US Data Privacy Framework or Standard Contractual Clauses) |
| Microsoft (Azure AI Document Intelligence) | A second reading of receipt images, to check the first | Receipt images (may show the merchant, card digits and names) | EU (Sweden) | To be confirmed |
| OpenAI LLC | Search vectors (embeddings) for the CSRD assistant's regulatory search | The question typed into the CSRD assistant | USA | To be confirmed |
| Company | Purpose | Personal data | Region | Transfer mechanism |
|---|---|---|---|---|
| Slack Technologies (Salesforce) | Internal notification of beta-tester applications; operational alerts | Applicant's name, email, company and reason; user IDs in operational alerts | USA | To be confirmed |
These receive or return data only when you connect your own account. They act on your instruction; Sustifi passes your request on.
| Company | Purpose | Personal data | Region | Transfer mechanism |
|---|---|---|---|---|
| Procountor (Finago / Accountor) | Importing invoices and ledger receipts | Your API key; invoice data including counterparties | Finland (EU), to be confirmed | None expected |
| Netvisor (Visma) | Importing invoices (coming soon: not yet open for new connections) | Your integration keys; invoice data | Finland (EU), to be confirmed | None expected |
| Lilith | Importing transactions and receipts | Your Lilith username and password (passed on once to open a session; only the encrypted session is stored); transactions and receipt files | Finland (EU), to be confirmed | None expected |
| Anthropic Admin API / GitHub (Microsoft) | Reading your own AI usage to calculate its emissions | Your admin key or token; your organisation's usage data | USA | The data originates in your own account with that provider |
We update this list before a new sub-processor starts processing personal data.
Questions: info@susti.fi