Subprocessors
Last updated: 14 August 2026
Flusso, operated by [Flusso legal entity name], uses the third-party providers below to deliver the service. Core subprocessors are always engaged. Optional subprocessors are engaged only when a company enables the relevant integration (e.g. connecting a bank, an accounting system, or the AI copilot). This register supports our Privacy Policy and Data Processing Agreement.
1.Current subprocessors
| Subprocessor | Purpose | Data | Region | Transfer basis |
|---|---|---|---|---|
MongoDB AtlasCore MongoDB, Inc. [confirm EU entity] | Primary datastore | All tenant data at rest | EU region [confirm pinned] | SCCs [confirm] |
NetlifyCore Netlify, Inc. [confirm] | Application hosting / serverless compute | All tenant data in transit; transient compute | EU region [confirm pinned] | SCCs [confirm] |
Anthropic (Claude)Optional Anthropic PBC | AI copilot answers (not used to train models) | Per-request financial summary + the user's question | United States | SCCs [+ DPF — confirm] |
StripeOptional Stripe Payments Europe, Ltd. (IE) / Stripe, Inc. (US) | Subscription billing + AI credits | Billing metadata (no card data on our servers) | EU / United States | SCCs / DPF [confirm] |
TinkOptional Tink AB (Sweden) | Bank aggregation + payment initiation | Bank connection, transactions, payment details | EU/EEA | — (within EU/EEA) |
finAPIOptional finAPI GmbH (Germany) | Alternative bank aggregation | Bank connection, transactions | EU/EEA | — (within EU/EEA) |
FabrickOptional Fabrick S.p.A. (Italy) [confirm] | Banking-as-a-Service: account information + SEPA / instant payment initiation | Bank account id, balances, transactions, payment details | EU/EEA [confirm] | — (within EU/EEA) [confirm] |
A-CubeOptional A-Cube S.r.l. (Italy) [confirm] | SDI e-invoicing aggregator | Invoice XML routed via SDI | EU/EEA | — (within EU/EEA) |
ArubaOptional Aruba S.p.A. (Italy) [confirm] | SDI e-invoicing provider | Invoice XML routed via SDI | EU/EEA | — (within EU/EEA) |
InvoicetronicOptional [confirm entity] (Italy) | SDI e-invoicing provider | Invoice XML routed via SDI | EU/EEA [confirm] | — (within EU/EEA) [confirm] |
OpenAPIOptional OpenAPI S.r.l. (Italy) [confirm] | SDI e-invoicing / company-data provider | Invoice XML routed via SDI; company lookups | EU/EEA | — (within EU/EEA) |
Fatture in CloudOptional TeamSystem S.p.A. (Italy) [confirm] | Accounting connector (OAuth) | Invoices synced | EU/EEA | — (within EU/EEA) |
TeamSystemOptional TeamSystem S.p.A. (Italy) [confirm] | Accounting / ERP connector (OAuth) | Invoices synced | EU/EEA | — (within EU/EEA) |
XeroOptional Xero Limited (New Zealand) [confirm EU entity] | Accounting connector (OAuth) | Invoices synced | New Zealand / EU [confirm] | SCCs [confirm] |
ResendOptional Plus Five Five, Inc. (US) [confirm] | Transactional email delivery (outbound) + optional inbound invoice ingestion (email-in) | Recipient email + message content; inbound: forwarded invoice attachments | United States [confirm] | SCCs [confirm] |
Browser push servicesOptional Google / Apple / Mozilla (per the user's browser) | Delivering browser push notifications | Push subscription endpoint + notification payload | United States / per vendor | SCCs [confirm] |
Frankfurter (ECB rates)Optional Frankfurter (public ECB reference data) | FX reference rates | None (no customer data sent) | EU | N/A (no personal data) |
2.International transfers
Where a subprocessor processes personal data outside the European Economic Area, the transfer is safeguarded by one of the mechanisms below. The specific basis for each provider is shown in the "Transfer basis" column above and must be confirmed against that provider's current data processing agreement.
- — (within EU/EEA): processing stays in the EU/EEA, so no transfer mechanism is required.
- SCCs:the European Commission's Standard Contractual Clauses, with supplementary measures where appropriate.
- DPF: the EU–US Data Privacy Framework, where the provider is certified.
- N/A: the provider receives no personal data.
Processing regions are being finalised as we pin our infrastructure to the EU; entries marked [confirm] are provisional pending that work and legal review.
3.Changes to this list
We may update this list as the service evolves. Under our Data Processing Agreement, we will give advance notice of intended additions or changes to subprocessors so customers acting as controllers can object on reasonable data-protection grounds. To receive change notices, or with any questions, contact admin@flusso.finance.