Subprocessors
Part A is annex 2 to the data processing agreement: providers that process customer content. Part B lists providers Mani IT uses for its own purposes as controller (website, user accounts, billing, support).
Draft: entries marked “under review” are completed before the open launch.
As of 21/10/2026
Part A: Subprocessors (customer content)
Hetzner Online GmbH
- Seat
- Industriestr. 25, 91710 Gunzenhausen, Germany
- Purpose
- Provision of the servers (Falkenstein data centre) and of the storage for backups (Storage Box)
- Data
- all customer content, encrypted in the backups
- Place of processing
- Germany (EU)
- Transfer safeguard
- processing within the EU, no third-country transfer
- Status
- active
Plus Five Five, Inc. (Resend)
- Seat
- 2261 Market Street #5039, San Francisco, CA 94114, USA
- Purpose
- Sending the emails a customer triggers from EaseAcc (invoices, quotes, reminders, invitations, appointment reminders), reporting their delivery status (delivered, bounced, delayed, marked as spam; opens and clicks are not tracked) and receiving receipts sent to a company's receipt address
- Data
- sender and recipient addresses, subject, content and attachments of the emails, delivery status
- Place of processing
- Sending: server region Ireland (EU), region eu-west-1; storage: Resend stores email content and related sending data in the USA, email and log data for 30 days on the standard plans
- Transfer safeguard
- EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) and the EU-US Data Privacy Framework, under which Resend is certified
- Status
- active
Proton AG
- Seat
- Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland
- Purpose
- Mailbox for support requests, as far as customers send content with them
- Data
- content the customer includes in a request (excerpts, files)
- Place of processing
- Switzerland
- Transfer safeguard
- EU Commission adequacy decision for Switzerland
- Status
- active
Enable Banking Oy
- Seat
- Otakaari 5, 02150 Espoo, Finland
- Purpose
- Retrieving account information (accounts, balance, transactions) from the customer's bank, read-only, through EaseAcc's own access with the account information service provider
- Data
- accounts and transactions of the connected accounts (name, IBAN, amounts, reference text), IP address and browser identifier of the user when consenting and fetching
- Place of processing
- Finland (EU); hosting under review
- Transfer safeguard
- processing within the EU (under review)
- Status
- planned, only once Mani IT has a contract with Enable Banking; for now every company uses its own access (see below)
Google Ireland Limited (Firebase Cloud Messaging)
- Seat
- Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose
- Delivery of notifications to Android devices, only for users of the Android app who allow notifications
- Data
- device token, text of the notification (by default without names and amounts)
- Place of processing
- under review
- Transfer safeguard
- under review
- Status
- planned, not active
Apple Inc. (Apple Push Notification Service)
- Seat
- One Apple Park Way, Cupertino, CA 95014, USA
- Purpose
- Delivery of notifications to iPhones, only for users of an iPhone app who allow notifications
- Data
- device token, text of the notification (by default without names and amounts)
- Place of processing
- USA
- Transfer safeguard
- under review
- Status
- planned, not active
On our own servers
Run on our own servers in Germany, without passing anything to third parties: PDF generation (Gotenberg), virus scanning of uploaded and emailed files (ClamAV; only virus signatures are downloaded from the internet), text recognition from PDF files and photos (Tesseract), and receipt recognition. No external services for text recognition or artificial intelligence are used.
Not subprocessors
Third parties to which the customer sends data or from which the customer takes data are not subprocessors: recipients of the customer's emails, the customer's bank, payment services, marketplaces and online shops whose reports or keys the customer stores, the customer's tax advisor, programs and AI assistants the customer connects through the API (the customer chooses their providers). Bank connection for now: every company that connects its bank uses its own free access at Enable Banking Oy and accepts its terms itself; EaseAcc stores the private key for it encrypted. The contract is then between the company and Enable Banking, which provides the account information service under its own licence. Lookups the customer triggers (such as checking a VAT ID in the European Commission's VIES) happen at the customer's request.
Part B: Service providers of Mani IT as controller
Hetzner Online GmbH
- Seat
- Industriestr. 25, 91710 Gunzenhausen, Germany
- Purpose
- Hosting of the website, the application and the backups
- Data
- connection data, account and contract data
- Place of processing
- Germany (EU)
- Transfer safeguard
- no third-country transfer
- Role
- processor
- Status
- active
Plus Five Five, Inc. (Resend)
- Seat
- 2261 Market Street #5039, San Francisco, CA 94114, USA
- Purpose
- Sending service emails (email confirmation, password reset, notifications, subscription invoices, contract notices), forwarding the contact form and internal alerts
- Data
- email address, name, content of the email, delivery status
- Place of processing
- Sending: server region Ireland (EU), region eu-west-1; storage: Resend stores email content and related sending data in the USA, email and log data for 30 days on the standard plans
- Transfer safeguard
- EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) and the EU-US Data Privacy Framework, under which Resend is certified
- Role
- processor
- Status
- active
Stripe Payments Europe, Ltd.
- Seat
- 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
- Purpose
- Processing of payments for subscriptions and archive access, customer portal for payment methods
- Data
- name, company, email address, billing address, payment data (entered at Stripe, not stored by EaseAcc), payment history
- Place of processing
- under review
- Transfer safeguard
- under review
- Role
- under review (independent controller or processor)
- Status
- test mode only for now
Proton AG
- Seat
- Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland
- Purpose
- Mailboxes for enquiries
- Data
- name, email address, content of the message
- Place of processing
- Switzerland
- Transfer safeguard
- EU Commission adequacy decision for Switzerland
- Role
- processor
- Status
- active
Cloudflare, Inc.
- Seat
- 101 Townsend St, San Francisco, CA 94107, USA
- Purpose
- Management of the DNS records of the domain easeacc.com only (name resolution); no proxy, no forwarding of content
- Data
- name resolution queries, usually from the DNS server of the visitor's internet provider
- Place of processing
- under review
- Transfer safeguard
- under review
- Role
- not classed as a processor (under review)
- Status
- active
The program code is managed and delivered through GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA); no customer content and no account data are processed in the course of this. Without any personal data, exchange rates are fetched from the European Central Bank, and when a password is set, the Pwned Passwords service receives only the first five characters of a hash.
Changes
We inform customers at least 30 days before engaging a further or replacement subprocessor from part A, by email and by updating this list (clause 9 of the data processing agreement).