Sub-processors
The third parties cobank engages to process data on its behalf, what they do, and where they process.
cobank engages the following sub-processors to provide the service. Each processes only the data needed for its purpose.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | Account identifiers, invoice and emission data, uploaded files | EU (Frankfurt) |
| Stripe | Subscription billing and payments | Name, email, billing and payment details | EU / US |
| Vercel | Application hosting and content delivery | Technical request data (IP address, user agent) | Global edge; EU functions |
| Google Cloud Vision | Invoice OCR — text extraction from images | Invoice images and their text | Outside EU/CH (US) |
| OpenAI | Line-item classification and extraction | Invoice line-item text | Outside EU/CH (US) |
International transfers
Google Cloud Vision and OpenAI process data outside Switzerland and the EU/EEA, and Stripe may process billing data in the US. Where data is processed outside Switzerland and the EU/EEA, cobank relies on an appropriate transfer mechanism, such as the Standard Contractual Clauses together with any measures required for Swiss data. See the Data Processing Agreement.
This list may change as the service evolves; material changes are notified so customers can object on reasonable grounds.