Pre-approved Sub-processors

DPA Annex B — Doc2iXBRL (Ontos B.V.)

Last updated: June 2026

Back to DPA

Supabase, Inc.

Database, authentication, file storage

Location: EU (AWS eu-central-1, Frankfurt)

Fly.io, Inc.

Backend application hosting

Location: EU (Amsterdam, NL)

Vercel, Inc.

Frontend hosting, serverless rendering, and content delivery

Location: EU (fra1, Frankfurt) for serverless functions; global edge CDN for static assets

OpenRouter, Inc.

AI model routing and API proxy for the AI processing steps (extraction, taxonomy mapping, validation, in-app assistants, bookkeeping interpretation)

Location: EU and US

Mistral AI SAS

EU-based OCR and text extraction from uploaded documents. Zero-Data-Retention is enabled and API data is not used for model training.

Location: European Union

Amazon Web Services EMEA SARL

Key Management Service (KMS) for envelope encryption of source documents; AWS processes only encrypted data keys and key metadata, never document plaintext

Location: EU (eu-north-1, Stockholm)

Functional Software, Inc. (d/b/a Sentry)

Application error tracking, performance monitoring, and session replay; document content is not sent (PII off, payloads scrubbed, replays masked)

Location: EU (Frankfurt) data region; US company, transfers under EU Standard Contractual Clauses

The Provider will notify the Customer of any changes to this list in accordance with Clause 4.2 of the Data Processing Agreement.

Subscribe to changes (RSS)

Get notified automatically whenever this list changes. Add the feed to any RSS reader.

Change history

  1. Mistral AI OCR processing updated

    Mistral AI SAS (France) provides EU-based OCR processing for uploaded documents with Zero-Data-Retention enabled. API data is not used for model training, and OCR processing remains EU-to-EU with no third-country transfer.

  2. Mistral AI added

    Mistral AI SAS (France) was added as a pre-approved sub-processor for EU-based OCR processing of uploaded documents. Zero-Data-Retention is requested, and API data is not used for model training.

  3. Sentry added

    Sentry (Functional Software, Inc.) was added as a sub-processor for application error tracking and performance monitoring. Document content is not sent: PII is disabled, payloads are scrubbed, and session replays are masked. Data is held in the EU (Frankfurt) region under EU Standard Contractual Clauses.

  4. Amazon Web Services (AWS KMS) added

    Amazon Web Services (AWS Key Management Service) was added as a sub-processor for envelope encryption of source documents. AWS processes only encrypted data keys and key metadata, never document plaintext.

  5. Google LLC removed

    Google LLC was removed from the sub-processor list.

  6. Sub-processor list published

    The list of pre-approved sub-processors was published as Annex B of the Data Processing Agreement.

Ontos B.V.

Email: contact@doc2ixbrl.com