Third parties that process personal data on our behalf. Under Swiss data protection law your organization is the controller and Apuva is the processor; engaging any sub-processor requires your prior authorisation, which is why this list is published and versioned. Adding an entry is a change to the Data Processing Agreement and is published as a new DPA version, which asks you to accept it again.
| Sub-processor | Purpose | Hosted in | Policy |
|---|---|---|---|
| Supabase | Database, authentication, and file storage (invoice and quote PDFs). | CH | Read |
| Vercel | Application hosting and compute. | US | Read |
| Stripe | Subscription billing and payment details. Only once your organization subscribes to a paid plan. | US | Read |
| Sentry | Error reporting from the application backend. Not currently in use — only once these credentials are configured by the operator. | US | Read |
| Resend | Delivery of e-mail sent by Apuva itself (not by your organization), currently the notice to an organization's owner when platform staff are granted emergency access. Processes the recipient address and the message content. | IE | Read |
| Anthropic | AI assistance features. An organization's own data is sent for phrasing, matching, or reading — including a photograph of a vehicle registration document when someone registers a vehicle that way. Photographs are sent for one reading and are not stored by us. Not currently in use — only once these credentials are configured by the operator. | US | Read |
| OpenAI | Alternative AI provider for the text features, and the provider used to transcribe a voice note into text where that is configured. It is not used to read document photographs. Not currently in use — only once these credentials are configured by the operator. | US | Read |
| bexio | One-way export of contacts and invoices, when an organization connects its own bexio account. Only if your organization connects this integration itself. | CH | Read |
| One-way export of scheduled jobs, when an organization connects its own Google Calendar. Only if your organization connects this integration itself. | US | Read |
Outbound email leaves through the SMTP account your organization configures in Settings, not a shared platform mailbox. That provider is engaged by you, not by us, so it is not one of our sub-processors — but it does process the content of the quotes, invoices and reminders you send.