Sub-processors
Last updated: 2026-10-05
To deliver xpense.events we rely on the third-party providers below. Each acts as a sub-processor: it processes personal data only on our documented instructions, under a data-processing agreement, and subject to confidentiality and security obligations. We give customers (controllers) advance notice of changes to this list so they may object.
Stripe is a partial exception. It processes billing data for us as a processor, and it also acts as a controller in its own right for purposes such as preventing fraud, managing security and financial risk, and meeting its own legal obligations, as set out in its data-processing agreement.
Current sub-processors
| Provider | Purpose | Data processed | Primary location | Transfer mechanism (if outside UK) |
|---|---|---|---|---|
| Vercel Inc. | Application hosting & serverless compute; Blob file storage | Account data, receipt images, logs | US company; functions pinned to London (lhr1), Blob store xpense-receipts in London (lhr1) | UK Addendum to EU SCCs (Vercel is the US entity; storage at rest is UK) |
| Neon Inc. | Primary Postgres database | All application data | UK: London (eu-west-2) | UK Addendum to EU SCCs (Neon Inc. is a US company; the data at rest is in London) |
| WorkOS Inc. | Authentication, organisations, user management (AuthKit) | Names, emails, login identifiers | United States | UK Addendum to EU SCCs |
| Anthropic, PBC (via Vercel AI Gateway) | AI OCR — reading receipt images to extract fields | Receipt image contents at time of processing | United States | UK Addendum to EU SCCs; zero data retention enabled |
| Stripe, Inc. | Subscription billing & payments | Billing contact, subscription/payment metadata | United States / UK (Stripe Payments UK Ltd) | UK Addendum to EU SCCs |
| Resend (Plus Five Five, Inc.) | Transactional & notification email | Recipient name, email, message content | United States | UK Addendum to EU SCCs |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports: technical details of a fault, with user and workspace identifiers | EU: Germany | UK Addendum to EU SCCs (Sentry is a US company; the data is stored in the EU) |
| Mapbox, Inc. | Driving-route distance for mileage claims | Route coordinates worked out from the postcodes entered on a mileage claim; no names or user identifiers | United States | UK Addendum to EU SCCs |
Integrations you connect
If your workspace admin connects your own accounting package (for example Xero), we send approved expenses from events you finalise to your account with that provider, on your instruction. That provider is not one of our sub-processors: it is your own system, under your own agreement with it, and you can disconnect it at any time from the Integrations page. The Integrations page lists exactly what is sent.
Notice of changes
We will post additions or replacements here and, where required by our customer agreements, notify controllers in advance so they can raise objections before the new sub-processor begins processing.
Contact
Questions about our sub-processors: privacy@xpense.events.