Subprocessors
Every third party that may process firm or client data on FinBoss's behalf, what it receives, where, and for how long. Firms are notified at least 30 days before a subprocessor is added and may object under the data processing addendum. Data residency for the database and storage is the United States (us-east-2).
| Provider | Purpose | Data | Region | Retention | Applies |
|---|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, secrets vault | All firm and client data at rest (encrypted); documents; integration tokens in the vault | US East (Ohio) | For the life of the account, then deleted per the DPA; point-in-time backups on a rolling window | Always |
| Vercel, Inc. | Application hosting and compute | Data in transit through the application; request logs without client personal information | United States | Logs 30 days | Always |
| Anthropic, PBC | Language model for drafting, extraction and narration | Prompt content for the step: relevant record fields under an opaque household id, retrieved knowledge, notes or transcripts; never account numbers or tax identifiers | United States | Zero data retention API terms; not used for training | When the firm's model key is configured |
| OpenAI, LLC | Text embeddings for knowledge retrieval | Chunks of the firm's knowledge documents and indexed client documents | United States | Zero data retention API terms; not used for training | When the firm's embedding key is configured |
| Resend, Inc. | Outbound email delivery | Approved email content, recipient address, the firm's sender identity | United States | Delivery logs per Resend's policy | When email sending is connected |
| Stripe, Inc. | Subscription billing | Firm name, billing contact, payment details (held by Stripe, never by FinBoss) | United States | Per Stripe's policy and applicable law | When the firm subscribes |
| Google LLC | Calendar read (OAuth) | Calendar events the adviser connects: titles, times, attendee addresses | United States | Tokens in the vault until disconnected; events mirrored while connected | When the adviser connects Google Calendar |
| Microsoft Corporation | Calendar read (OAuth) | As for Google Calendar | United States | As for Google Calendar | When the adviser connects Microsoft 365 |
| Meta Platforms, Inc. | Publishing approved marketing to a Facebook Page and Instagram | Approved post content only; the Page token in the vault | United States | Published content lives on the Page; token until disconnected | When the firm connects a Page |
| Expo (650 Industries, Inc.) | Push notifications to the mobile app | Device push token, a notification title and generic sentence, a deep link id — never client details | United States | Transient | When a member installs the mobile app |
Not subprocessors: the firm's own calendar, email and social accounts are the firm's; FinBoss reads or writes them on the adviser's instruction under the adviser's authorisation. Archive connectors (Smarsh, Global Relay, Proofpoint) are planned for Enterprise and will be listed here before use.