Snapshot 187440
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Service Providers and Recipients faktoora uses the following carefully selected third-party providers to provide, support and secure our platform. We review our providers regularly and on a risk basis (see below). Infrastructure Sub-processor Purpose Location Certifications Hetzner Online GmbH Hosting, storage and backup infrastructure Germany (EU) ISO 27001, BSI C5 Type 2 The application's error monitoring runs on our own infrastructure at this provider – no external monitoring service receives error data. Payments Service provider Purpose Location Stripe Payment processing and management of your faktoora subscription (no processing of your customer data) Ireland and USA (EU-US Data Privacy Framework, EU Standard Contractual Clauses) Regulated Payment Services Provider Purpose Location BANKSapi Technology GmbH Account information and payment initiation, if you connect a bank account or initiate a transfer from faktoora Germany BANKSapi is a payment institution licensed by the German Federal Financial Supervisory Authority (BaFin) and provides these regulated services to you as an independent controller on the basis of your explicit consent under payment services law. Communication Sub-processor Purpose Location Mailjet (Sinch Group) Transactional email delivery (invoices, notifications) EU (Germany, Belgium); support access from the USA on the basis of the EU-US Data Privacy Framework and the EU Standard Contractual Clauses The Sinch Group operates an information security management system certified to ISO/IEC 27001:2022. We have a signed data processing agreement with Sinch, including the EU Standard Contractual Clauses. E-Invoicing Recipient Purpose Location Peppol network Pan-European delivery of e-invoices Depending on where the invoice recipient is based Invopop (sub-processor) Transmission of French e-invoices and status messages via a state-approved platform (France only) EU (Belgium, Germany); message relay without storage also via a service provider in the USA AEAT (Spanish tax authority) VeriFactu invoice registration (Spain only) Spain (EU) KSeF (Polish Ministry of Finance) Clearance of Polish e-invoices (Poland only) Poland (EU) French tax administration (DGFiP) Receipt of the invoice and status data of French e-invoices via Invopop (France only) France (EU) Invopop is a sub-processor within the meaning of our Data Processing Agreement (Annex 3) and is certified to ISO/IEC 27001:2022. Tax authorities receive this data because your organisation is legally obliged to transmit it; we transmit it on your behalf. AI Services All AI-assisted features are optional. Service provider Purpose Data scope Location Mindee Automatic data extraction from incoming invoice files, if enabled for your account The uploaded incoming invoice file; extracted data is deleted upon retrieval, at the latest after 2 hours; Mindee does not store the file EU OpenAI Optional AI-assisted document search Only the search term entered – no documents or customer records. Please do not enter any personal data in search terms. USA (EU Standard Contractual Clauses) Services used exclusively on our website (such as web analytics subject to consent) are described in our privacy policy. Data Protection Provider Purpose Location PROLIANCE GmbH External data protection officer Germany (Munich) Customer-Configured Integrations The following services process customer data only if they have been explicitly configured and authorised by the customer. faktoora does not send any data to these services as long as the customer has not enabled the integration. Service Category Purpose Xero Accounting Synchronisation of invoices and contacts DATEV Accounting Data exchange with tax advisers Bexio Accounting Swiss accounting synchronisation Weclapp ERP Synchronisation of business processes HubSpot CRM Synchronisation of contacts and companies Pipedrive CRM Synchronisation of contacts Monday.com Project management Synchronisation of invoice data Daylite CRM Synchronisation of contacts Microsoft Entra ID Identity Optional sign-in with your organisation's Microsoft account Microsoft 365 / Outlook Email Optional sending and receiving via your organisation's Microsoft mailbox Own SMTP/IMAP server Email Customer-provided email servers for sending and receiving Own webhooks Integration Customer-defined HTTP endpoints for event notifications Customers maintain their own relationships and agreements with these providers. For these integrations, faktoora acts on the customer's instructions. Some of these providers process data outside the EU (e.g. USA, United Kingdom, Australia); these transfers take place on the customer's instruction on the basis of the safeguards of the respective provider, such as the EU Standard Contractual Clauses. Selection Criteria When selecting sub-processors, we assess: Data location – processing in the EU preferred; third-country transfers only with appropriate safeguards Security certifications – ISO 27001, SOC 2, PCI DSS or equivalent for critical services Data processing agreements – for all providers that process personal data on our behalf Encryption – TLS in transit and encryption at rest for critical services Incident notification – obligation to report personal data breaches promptly Review Schedule We review our suppliers regularly and on a risk basis; critical services more frequently and in greater depth than others. Changes to This List In accordance with clause 7 of our Data Processing Agreement, we generally inform customers at least three weeks before we engage a new sub-processor that processes personal data on their behalf. If you have questions about our sub-processors, please contact compliance@faktoora.com.