Subprocessors

This page lists the main third-party providers used to run the service. It is intended as an operational overview, not as a marketing page.

Last updated: August 4, 2026

The service is operated by DPmedia in Poland, European Union. Providers may change over time as the product evolves, but this list is kept in the public trust docs so users and reviewers can see the current stack.

Current providers

Cloudflare

Category: Hosting, database, and file staging

Purpose: Runs the web application and API (Workers and Containers), stores structured analysis results and account data (D1), and briefly stages large uploads (R2).

Data handled: Application requests, extracted transaction data, account data, and uploaded statement files while they are processed.

Notes: D1 database and R2 storage are located in Western Europe and encrypted at rest. Staged uploads are deleted after processing, and automatically after one day at the latest.

Google Gemini API

Category: AI processing

Purpose: Helps categorize transactions and power AI-assisted analysis features.

Data handled: Relevant structured text needed for categorization and analysis prompts, and page images of scanned or photographed statements.

Notes: Used through API-based processing, not via bank-account connectivity.

Polar

Category: Payments

Purpose: Billing provider for subscriptions, one-time purchases, checkout, and customer portal flows.

Data handled: Payment and billing information needed for subscriptions.

Notes: Card details go directly from the browser to Polar.

PostHog

Category: Product analytics and session replay

Purpose: Measures traffic, product funnels, conversion, and aggregated product usage.

Data handled: Page paths, product events, attribution metadata, and masked interaction recordings.

Notes: Input values are masked. Session replay is disabled on results, dashboard, settings, and claim pages.