Sub-processor List
Last updated 2026-05-25 (DRAFT)
In accordance with our Data Processing Agreement (GDPR Article 28(2)), we publish this list of sub-processors that may access or process Customer Data on Pactaro's behalf. All sub-processors are bound by data processing agreements with Pactaro and provide equivalent data protection guarantees.
Approved Sub-processors
| Sub-processor | Jurisdiction / Data Location | Purpose | Data Accessed |
|---|---|---|---|
| Supabase | Frankfurt, Germany (EU) | Managed PostgreSQL database, authentication, real-time, and storage infrastructure. All Customer Data at rest. | Invoice data, account data, OAuth tokens (encrypted), user session data |
| Cloudflare R2 | EU region (Western Europe) | Object storage for archived invoice files (XML, PDF). Also provides CDN and DDoS protection for the web application. | Invoice XML files and PDFs |
| Stripe | Ireland (EU) — data stored in EEA | Payment processing, subscription billing, invoicing. | Customer billing contact details, payment method tokens. Card numbers are never passed through Pactaro. |
| Invopop | Spain (EU) | EU e-invoicing format conversion and delivery to national networks (Peppol, SDI, Chorus Pro, etc.). | Invoice data including buyer/seller details, line items, VAT IDs |
| Trigger.dev | EU region | Background job processing for invoice ingestion, conversion, and delivery pipelines. | Invoice data passed through job payloads during processing |
| Sentry | Frankfurt, Germany (EU) — EU region instance | Error monitoring and application performance monitoring. | Error stack traces, request metadata. Configured to scrub PII from payloads. |
| Vercel | EU Edge Network | Hosting and serving the Next.js web application, including server-side rendering at EU edge nodes. | HTTP request metadata, edge logs. Customer Data is not stored on Vercel infrastructure. |
| Resend | TBD — will be confirmed before activation | Transactional email delivery (account confirmations, invoice delivery failure notifications, billing receipts). | Customer email addresses, email content |
Sub-processor Change Notification
We will notify Customers of any intended addition or replacement of a sub-processor at least 30 days in advance via email to the account's billing contact and/or in-app notification. Customers who have signed a DPA may object to a new sub-processor as described in the DPA.
Contact
Questions about our sub-processor relationships? Contact dpo@pactaro.eu.
Pactaro B.V.
Prinsengracht 412, 1016 HP Amsterdam, Netherlands