Subprocessors

Who else processes your data.

Last updated: 2026-08-01

To run Taxottic we rely on a short, vetted list of vendors. We do not engage a new subprocessor without first reviewing their security practices and data-protection commitments. We update this page when we add or change a vendor and announce material changes in-app at least 30 days before they take effect.

The certifications listed below are the vendors' own, not Taxottic's. Taxottic has not been through a third-party security audit, and we do not claim one.

Vercel

Their privacy notice ↗

Role

Hosting + CDN for the Taxottic web app.

Data processed

HTTP request metadata, IP at request time (not stored long-term).

Region

United States (global edge for static assets).

Certifications

SOC 2 Type II, ISO 27001, GDPR-aligned DPA.

Supabase

Their privacy notice ↗

Role

Postgres database, authentication, storage of user files.

Data processed

All application data (tax profiles, expenses, conversations, bank metadata).

Region

United States (AWS us-east-1).

Certifications

SOC 2 Type II, HIPAA-eligible, GDPR-aligned DPA.

Plaid

Their privacy notice ↗

Role

Bank connectivity, transaction sync.

Data processed

Bank account ID, transaction merchant + date + amount, institution name. Bank credentials are entered into Plaid's UI and never reach Taxottic.

Region

United States.

Certifications

SOC 2 Type II, ISO 27001:2013, AICPA SOC for Service Organisations.

Anthropic

Their privacy notice ↗

Role

Powers Bella (our in-app AI guide), reads the receipts, pay stubs, W-2s and prior-year tax documents you scan, and suggests categories for imported bank transactions.

Data processed

Your questions to Bella and recent conversation turns, a summary of your tax and company situation including year-to-date income and expense totals, the complete file you scan (the whole image or PDF is sent, not only the fields we ask for), and bank transaction descriptions, amounts and dates.

Region

United States.

Certifications

SOC 2 Type II. Under our commercial terms, customer content is not used to train general models.

Stripe

Their privacy notice ↗

Role

Subscription and credit-pack billing, and, if you connect one, Stripe as an income source.

Data processed

Email, billing address and payment details you enter in Stripe-hosted checkout. Card numbers never reach Taxottic and we store none. For a connected Stripe account, the payout and charge records we sync back.

Region

United States.

Certifications

PCI DSS Level 1, SOC 1 / SOC 2 Type II, ISO 27001.

Google Maps Platform

Their privacy notice ↗

Role

Draws the maps and route thumbnails on the mileage screens, turns coordinates into place names, and geocodes addresses you type.

Data processed

Precise trip coordinates. Route points are included in the map-image request, and the first and last point of a drive are sent to be resolved to a street address and a nearby business name. Addresses you type for saved places are also sent.

Region

United States and Google's global infrastructure.

Certifications

ISO 27001, SOC 2/3.

Google (sign-in and push)

Their privacy notice ↗

Role

Optional sign-in via Google OAuth, optional Google Calendar connection, and delivery of Android push notifications via Firebase Cloud Messaging.

Data processed

Name, email, profile photo from the openid email profile scopes. Calendar data only if you connect a calendar. For push: your device token and the short notification text.

Region

United States.

Certifications

ISO 27001, SOC 2/3, FedRAMP.

Apple

Their privacy notice ↗

Role

Delivery of push notifications to iPhones and iPads.

Data processed

Your device token and the short notification text.

Region

United States and Apple's global infrastructure.

Certifications

ISO 27001, SOC 2.

Microsoft

Their privacy notice ↗

Role

Optional sign-in via Microsoft Identity Platform, and optional Outlook calendar connection for firms.

Data processed

Name, email, profile photo from the openid email profile scopes. Calendar data only if you connect a calendar.

Region

United States and EU (per Microsoft's regional model).

Certifications

SOC 1/2/3, ISO 27001, FedRAMP.

Resend

Their privacy notice ↗

Role

Sends transactional email: sign-in links, invitations, receipts, reminders, and security notices.

Data processed

Your email address and the contents of the message we send you.

Region

United States.

Certifications

SOC 2 Type II, GDPR-aligned DPA.

Documenso

Their privacy notice ↗

Role

Electronic signature for firm documents, on an instance we run.

Data processed

The document sent for signature, and the signer's name, email, and signature event record.

Region

United States.

Certifications

Self-hosted by Techno Optics LLC on our own infrastructure.

DocuSign

Their privacy notice ↗

Role

Alternative electronic signature provider for firms that choose it.

Data processed

The document sent for signature, and the signer's name, email, and signature event record.

Region

United States.

Certifications

SOC 1/2 Type II, ISO 27001, PCI DSS.

Zoom

Their privacy notice ↗

Role

Optional meeting links for firms that connect Zoom to their scheduling.

Data processed

Meeting metadata for appointments a firm creates. Meeting contents are not sent to or stored by Taxottic.

Region

United States.

Certifications

SOC 2 Type II, ISO 27001.

Want a Data Processing Agreement (DPA)? See our standard template at /legal/dpa, or write to privacy@taxottic.com.