Steightment Subprocessors

DRAFT — NOT LEGAL ADVICE. Prepared by engineering for review by counsel (finding SEC-10, release stage R6). The list was derived from the code and environment configuration as of the date below. Counsel and Marco should confirm the contracting entities, regions and DPAs before it is relied on.

Last updated: 2026-10-08 · Questions: privacy@steightment.com

A subprocessor is a third party that Steightment uses to process customer data on a customer's behalf. We give workspace owners at least 30 days' notice before adding or replacing a subprocessor that processes customer data (see the DPA, section 5).

Core infrastructure (all workspaces)

Subprocessor	Purpose	Customer data categories	Region / location
Vercel Inc.	Application hosting, serverless functions, scheduled jobs, request logs	All data in transit through the app; request logs (IP, URL path, user agent)	United States (default region iad1, Washington DC)
Neon Inc.	Primary Postgres database, backups and point-in-time restore	All stored workspace data: ledger, transactions, awards, invoices, customers, labor allocations, audit log, user and membership records, encrypted integration tokens	AWS us-east-1 (N. Virginia, USA)
Cloudflare, Inc. (R2)	Object storage for uploaded documents, receipts, logos and generated PDFs	Document files and their contents (receipts, invoices, statements, evidence)	Cloudflare R2 "auto" placement; jurisdiction not pinned (to confirm)
Clerk, Inc.	Authentication, sessions, multi-factor authentication	Name, email address, authentication and session records, second-factor enrollment	United States
Resend (Plus Five Five, Inc.)	Transactional email (notifications, invoices, statements, digests)	Recipient email addresses and email content, which can include invoice amounts, customer names and financial summaries; bounce and complaint events	United States (us-east-1 sending region)
Functional Software, Inc. (Sentry) — only when `SENTRY_DSN` is configured	Error monitoring	Error messages, stack traces, route paths and tenant identifiers. Secrets, tokens, cookies and query strings are scrubbed before sending (`src/server/sentry.ts`)	United States (to confirm per Sentry org region)

AI processing

Subprocessor	Purpose	Customer data categories	Region / location
OpenRouter, Inc. — active provider (`AI_PROVIDER=openrouter`)	Routes AI requests to the model provider	Transaction descriptions and amounts for categorization; document images/PDFs for receipt and invoice extraction; financial summaries and questions for the CFO advisor	United States
Anthropic, PBC (Claude models, through OpenRouter or the Vercel AI Gateway)	Model inference	As above	United States
Vercel Inc. (AI Gateway) — only when `AI_PROVIDER=claude`	Alternative AI routing	As above	United States

AI requests are metered per workspace and limited to the data the feature needs. Steightment does not use customer data to train models. The provider terms that cover retention and training by OpenRouter and Anthropic should be confirmed by counsel.

Integrations (only when a workspace connects or uses them)

Subprocessor	Purpose	Customer data categories	Region / location
Plaid Inc.	Read-only bank connections, transaction and balance sync	Bank account metadata, transactions, balances. Plaid holds the bank credentials; Steightment never sees them	United States
Intuit Inc. (QuickBooks Online)	Two-way accounting sync, invoice push	Chart of accounts, transactions, invoices, customers, vendors	United States
Stripe, Inc.	Subscription billing for Steightment plans	Billing contact name and email, workspace name, plan and payment status. Card data goes directly to Stripe	United States
Melio Payments, Inc. — payments feature; dry-run by default	Bill payment rails	Payee (vendor) names and bank details, bill amounts, payment status	United States
Mercury Technologies, Inc. — payments feature; dry-run by default	Banking API for payments	Recipient names and account details, payment amounts, payment status	United States
Beyond Pricing, Inc. — short-term-rental workspaces only	Pulls listing and nightly-pricing data	The workspace's Beyond Pricing API token and the listing and pricing data returned	United States

Not subprocessors (for completeness)

Grants.gov and ProPublica Nonprofit Explorer: public-data lookups (grant opportunities, IRS Form 990 data). The requests contain search terms or an organization's EIN, never workspace financial data.
Airbnb: data flows into Steightment through the user's browser extension. Steightment sends nothing to Airbnb.
Amazon Web Services (App Runner, Bedrock): planned under the AWS conversion plan, but not in use as of the date above. This list will be updated, with notice, before any customer data reaches AWS directly. (Neon already runs on AWS infrastructure, as listed above.)