Public Subprocessor Register

This register accompanies the Fintable privacy policy. It identifies suppliers used to operate and support Fintable, plus other recipients relevant to your choices. A supplier is a subprocessor when it processes personal data on Fintable's behalf while Fintable acts as a processor. The same supplier may have other roles for its own account, billing or regulatory activities.

Verification status: the services and purposes below have been identified from our operations. Exact contracting affiliates, all processing and support-access countries, and Fintable's account-specific contractual transfer safeguards have not yet been verified for every supplier. A location based on public provider information is not a Fintable data-residency commitment. This register is not a signed processing agreement or blanket customer authorization.

Infrastructure and communications

Provider	Purpose and data involved	Processing locations
Cloudflare	Website delivery, security and traffic filtering; network identifiers, requests and responses passing through its services.	Global network, including the United States. No Fintable-specific regional restriction verified.
Bunny.net / BunnyWay d.o.o.	Delivery of the Ukrainian website; visitor network information and content served through the network.	Provider based in Slovenia; global delivery network. Exact processing countries not verified.
DigitalOcean, LLC	Storage of encrypted off-site database backups, including customer account and financial data.	Configured storage in Frankfurt, Germany. Additional support and administrative locations not verified.
Tailscale Inc.	Administrative networking; device, user and connection metadata, and encrypted traffic where relayed.	Provider identifies Canada, Germany, the United States and the UK, with possible processing elsewhere. Encrypted traffic is distinct from readable metadata.
Google — Workspace / Gmail	Support email, attachments and customer correspondence.	Account-specific storage region, support locations and contracting affiliate not verified.
Postmark / AC PM LLC	Onboarding, service and marketing email delivery; recipient details, message contents and delivery information.	Account-specific processing countries and contracting affiliate not verified.
Sentry	Browser and server error monitoring, including background jobs; customer account IDs, error messages, stack traces, and browser and request metadata. Diagnostic context may contain personal or financial information.	Production is configured to use Sentry's United States ingestion endpoint. Additional processing and support-access locations, contracting entity and account-specific transfer safeguards remain unverified.

Fintable's servers are hosted in Ukraine, except where an agreement or law requires otherwise. For example, data from Akoya connections is hosted in the United States. Fintable itself is not a third-party subprocessor in this list. Support, development and recovery environments may contain production copies; their complete country and remote-access inventory remains under verification.

AI services used by Fintable

These services may receive support correspondence, attachments, screenshots, relevant account or financial information, diagnostic material, or prompts and example transactions used with AI features. A fallback receives the material for the request it handles. We do not imply that every customer's data is sent to every provider.

Provider	Purpose	Processing locations and status
OpenAI	Support investigation, search embeddings, drafting, engineering assistance and an AI fallback.	International processing; no Fintable-specific residency restriction verified. Contracting affiliate and terms depend on the service account.
Anthropic	Engineering, support and security assistance, including the Cyber Verification Program.	International processing; no Fintable-specific residency restriction verified. Account-specific contractual coverage remains to be confirmed.
xAI / Grok	AI assistance, including support drafting, attachment interpretation and category-rule assistance.	Provider terms describe processing in the United States. Account-specific contracting entity and safeguards remain to be confirmed.
DeepSeek	Configured fallback for AI requests, including support and category-rule assistance.	Provider identifies processing and storage in China. Account-specific contractual coverage remains to be confirmed.
Moonshot AI / Kimi	Fallback repair of AI responses, including support proofreading output that may quote customer correspondence or contain personal and financial data.	The provider's OpenPlatform privacy policy identifies storage in Singapore. Fintable's account-specific processing and support-access locations, contracting entity and transfer safeguards remain unverified.

Retention and model-training terms vary by product and account. A link to a public privacy policy does not confirm a particular enterprise agreement, training exclusion or international-transfer mechanism for Fintable.

Other recipients and customer-selected services

These are disclosed for transparency. They are not all classified as Fintable subprocessors; their role depends on the service and applicable agreement.

• Financial connections: Plaid, GoCardless Bank Account Data (formerly Nordigen), Akoya and SnapTrade, and the banks or brokerages involved in your selected connection. Direct bank integrations and existing Finicity connections may also apply. They exchange identification, authorization, account, transaction or investment data needed for the connection. Availability varies by institution. Countries and legal roles depend on the connection; no common EU-only commitment is verified.
• Destinations you choose: Airtable, Google Sheets and Notion receive data selected for synchronization. Your agreement and settings with the destination determine its processing locations and retention.
• AI assistants you connect: your selected provider receives authorized tool results, separately from Fintable's own AI services above. Your provider account and its terms apply.
• Subscription payments: Stripe, FastSpring or LiqPay receive billing, order and payment information depending on the payment route. Payment or merchant-of-record roles and invoicing entities depend on the checkout arrangement. No single processing location or invoicing entity has been verified for every route.
• Analytics and advertising: Google Analytics receives usage and purchase events and identifiers. Where enabled, OpenAI advertising measurement receives advertising and conversion events, browser and IP information, and hashed matching identifiers. Connected bank transactions are not sent as advertising events. Processing countries and applicable account terms remain to be confirmed.
• Professional advisers and authorities: information needed for accounting, legal advice, disputes or a lawful disclosure requirement.

Transfers, changes and questions

We have not yet verified an applicable transfer mechanism for every route listed here. A supplier's European location, an encrypted backup or published contractual terms do not establish that all transfers are covered. The privacy policy explains the current position and how to request applicable safeguards.

We update the date and entries when this register changes. Any notice, authorization or objection procedure required by an applicable processing agreement or law remains separate; publication alone does not replace it. For supplier identities, locations, safeguards or questions about a proposed arrangement, contact [email protected].