Sub-processors
As of September 2026 · Annex 1 to the data processing agreement (Art. 28 GDPR)
When you use FirmaCenter, we process the data stored in the software on your behalf. We use the service providers listed below to do so. This list forms an annex to the data processing agreement and is kept up to date.
Supabase
Database, account management and file storage. All data you create in the software is processed: client and employee data, invoices, receipts, projects, time records and documents. Storage location: data centre in Ireland (EU). The provider is based in the USA; the EU Standard Contractual Clauses apply to support access from a third country.
Vercel
Operation of the website and the web dashboard. Technical connection data is processed (IP address, time, page requested, browser details). Operated in the Dublin region (Ireland); the provider is based in the USA, with transfers based on the Standard Contractual Clauses.
Stripe
Processing of subscription payments made through the website. Your billing and payment data is processed. Registered office: Stripe Payments Europe, Limited, Ireland. Stripe processes part of the data as an independent controller, for example for fraud prevention.
Resend
Delivery of system and invoice e-mails, for example registration confirmation, password reset and sending invoices to your clients. The recipient address, subject and content of the message and the delivery status are processed. The provider is based in the USA; transfers are based on the Standard Contractual Clauses.
Anthropic (currently not active)
Anthropic, PBC (USA) is intended for automatic receipt recognition. The feature is currently switched off; no data is transmitted to Anthropic. Before activating it we will inform you in line with the section “Changes to this list”, including the data transmitted, the retention period and the basis for the third-country transfer.
OpenRouteService and Photon
Distance calculation and address search in the mileage log. Only the start and destination addresses or search terms you enter are transmitted — without name, e-mail address or account ID; requests are made from our server, not from your device. Providers: HeiGIT gGmbH, Heidelberg (OpenRouteService) and komoot GmbH, Potsdam (Photon).
Distribution of the Android app through Google Play and attribution of installations via the Install Referrer interface. Google Ireland Limited, Ireland. There are no in-app purchases; subscriptions are concluded exclusively through our website. If you sign in with Google (Google Sign-In), Google transmits your name, e-mail address, profile picture and Google account ID to us.
Changes to this list
We will inform you at least 30 days in advance, by e-mail to the address held in your account, before adding or replacing a sub-processor. Within that period you may object for good cause; if no agreement is reached, you may terminate the contract with effect from the date the change takes effect.