Service Providers and Recipients
faktoora uses the following carefully selected third-party providers to provide, support and secure our platform. We review critical providers on a defined schedule (see below).
Infrastructure
| Sub-processor | Purpose | Location | Certifications |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, storage and backup infrastructure | Germany (EU) | ISO 27001, BSI C5 Type 2 |
The application's error monitoring runs on our own infrastructure at this provider – no external monitoring service receives error data.
Payments
| Service provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and management of your faktoora subscription (no processing of your customer data) | Ireland and USA (EU-US Data Privacy Framework, EU Standard Contractual Clauses) |
Regulated Payment Services
| Provider | Purpose | Location |
|---|---|---|
| BANKSapi Technology GmbH | Account information and payment initiation, if you connect a bank account or initiate a transfer from faktoora | Germany |
BANKSapi is a payment institution licensed by the German Federal Financial Supervisory Authority (BaFin) and provides these regulated services to you as an independent controller on the basis of your explicit consent under payment services law.
Communication
| Sub-processor | Purpose | Location |
|---|---|---|
| Mailjet (Sinch Group) | Transactional email delivery (invoices, notifications) | EU (Germany, Belgium); support access from the USA on the basis of the EU-US Data Privacy Framework and the EU Standard Contractual Clauses |
The Sinch Group operates an information security management system certified to ISO/IEC 27001:2022. We have a signed data processing agreement with Sinch, including the EU Standard Contractual Clauses.
E-Invoicing
| Recipient | Purpose | Location |
|---|---|---|
| Peppol network | Pan-European delivery of e-invoices | Depending on where the invoice recipient is based |
| Invopop | Transmission of French e-invoices and status messages via a state-approved platform (France only) | EU (Belgium, Germany); message relay without storage also via a service provider in the USA |
| AEAT (Spanish tax authority) | VeriFactu invoice registration (Spain only) | Spain (EU) |
| KSeF (Polish Ministry of Finance) | Clearance of Polish e-invoices (Poland only) | Poland (EU) |
| French tax administration (DGFiP) | Receipt of the invoice and status data of French e-invoices via Invopop (France only) | France (EU) |
Invopop is certified to ISO/IEC 27001:2022.
Tax authorities receive this data because your organisation is legally obliged to transmit it; we transmit it on your behalf.
AI Services
All AI-assisted features are optional.
| Service provider | Purpose | Data scope | Location |
|---|---|---|---|
| Mindee | Automatic data extraction from incoming invoice files, if enabled for your account | The uploaded incoming invoice file; extracted data is deleted after retrieval | EU |
| OpenAI | Optional AI-assisted document search | Only the search term entered – no documents or customer records. Please do not enter any personal data in search terms. | USA (EU Standard Contractual Clauses) |
Services used exclusively on our website (such as web analytics subject to consent) are described in our privacy policy.
Data Protection
| Provider | Purpose | Location |
|---|---|---|
| PROLIANCE GmbH | External data protection officer | Germany (Munich) |
Customer-Configured Integrations
The following services process customer data only if they have been explicitly configured and authorised by the customer. faktoora does not send any data to these services as long as the customer has not enabled the integration.
| Service | Category | Purpose |
|---|---|---|
| Xero | Accounting | Synchronisation of invoices and contacts |
| DATEV | Accounting | Data exchange with tax advisers |
| Bexio | Accounting | Swiss accounting synchronisation |
| Weclapp | ERP | Synchronisation of business processes |
| HubSpot | CRM | Synchronisation of contacts and companies |
| Pipedrive | CRM | Synchronisation of contacts |
| Monday.com | Project management | Synchronisation of invoice data |
| Daylite | CRM | Synchronisation of contacts |
| Microsoft Entra ID | Identity | Optional sign-in with your organisation's Microsoft account |
| Microsoft 365 / Outlook | Optional sending and receiving via your organisation's Microsoft mailbox | |
| Own SMTP/IMAP server | Customer-provided email servers for sending and receiving | |
| Own webhooks | Integration | Customer-defined HTTP endpoints for event notifications |
Customers maintain their own relationships and agreements with these providers. For these integrations, faktoora acts on the customer's instructions. Some of these providers process data outside the EU (e.g. USA, United Kingdom, Australia); these transfers take place on the customer's instruction on the basis of the safeguards of the respective provider, such as the EU Standard Contractual Clauses.
Selection Criteria
When selecting sub-processors, we assess:
- Data location – processing in the EU preferred; third-country transfers only with appropriate safeguards
- Security certifications – ISO 27001, SOC 2, PCI DSS or equivalent for critical services
- Data processing agreements – for all providers that process personal data on our behalf
- Encryption – TLS in transit and encryption at rest for critical services
- Incident notification – obligation to report personal data breaches promptly
Review Schedule
| Supplier classification | Review |
|---|---|
| Critical | Quarterly |
| Important | Annually |
| Standard | Annually |
Changes to This List
We inform customers before we engage a new sub-processor that processes personal data on their behalf – in accordance with our Data Processing Agreement. If you have questions about our sub-processors, please contact compliance@faktoora.com.