Security
Generated from FinBaze's published privacy policy, version 2026-10-10 (last updated 10 October 2026), which the data processing agreement incorporates. This page cannot differ from it.
| Provider or recipient | Purpose and location |
|---|---|
| Aurtic and related infrastructure | Hosting, databases, email delivery, infrastructure and access logging in France / the European Union |
| Anthropic | AI-assisted features |
| OpenAI | AI-assisted features |
| AI-assisted features | |
| Amazon | AI-assisted features |
| TypeSafe | AI-assisted features |
| Lunch Flow | Open banking and bank-transaction synchronisation |
| Bird / MessageBird | WhatsApp delivery; Bird is configured by FinBaze not to retain message content |
| Stripe | Subscription payments, connected payment functionality and billing |
| Gotenberg (self-hosted) | PDF generation |
| Digipoort and Belastingdienst | Dutch tax submissions and related responses |
| Kamer van Koophandel (KvK) | Dutch company-information lookups |
| Google Analytics (Google Ireland Limited / Google LLC) | Usage measurement for the FinBaze marketing website and bookkeeping platform (web) |
| Microsoft Clarity (Microsoft Ireland Operations Limited / Microsoft Corporation) | Usage measurement, heatmaps and session recordings for the FinBaze marketing website, bookkeeping platform (web) and mobile applications |
| Sign-in, maps and calendar functionality | |
| Google (Workspace APIs, including Gmail) | Read-only access to a mailbox the customer connects. FinBaze monitors only for invoice-related keywords and discards any other email without storing its content. Google Workspace API user data is strictly excluded from being used to train or improve FinBaze's in-house generalized AI/ML models. Use of this data adheres to the Google User Data Policy, including the Limited Use requirements |
| Apple | Sign-in functionality |
| Customer-enabled payment providers and shops | Integrations enabled and instructed by the customer |
| Customer-selected email providers | Delivery through email infrastructure configured by the customer |
| Professional advisers, authorities and courts | Advice, legal claims and compliance with lawful requirements |
Some recipients, such as government bodies or customer-selected integration providers, may act as independent controllers. A material new sub-processor is announced in advance and customers may object within 15 days on data-protection grounds (DPA, section 6).
Which of these apply to a platform company: the embedded components (embed app, component library, browser SDK) load no analytics, session replay or advertising script. Platform companies never reach FinBaze's push provider (Messages).