Legal
Sub-processor List
Last updated 6 September 2026
What counts as a sub-processor here
A sub-processor is a third party Statio contracts that may process customer personal data on Statio's instruction. It is NOT:
- The customer's own tools. When Statio calls Exact Online, e-Boekhouden, Jortt, Moneybird, Mollie, Shopify, WooCommerce, bol.com, Gmail or Microsoft Graph, it does so with credentials the customer supplied, against the customer's own account, on the customer's instruction. Those providers are the customer's processors, not Statio's. They are listed separately in Annex B2 of the DPA as "customer-directed integrations" for transparency.
- Public reference lookups. VIES (European Commission) and KVK (Dutch business register) receive a counterparty VAT/KVK number — business-register identifiers, not the customer's own personal data. ECB receives nothing (FX rate pull only).
Annex B1 — Statio's sub-processors
| # | Sub-processor | Legal entity / location | Purpose | Data it can see | Transfer basis |
|---|---|---|---|---|---|
| 1 | UpCloud | UpCloud Ltd (Finland); processing region: Netherlands (nl-ams1) | All hosting: Managed Kubernetes, PostgreSQL, object storage (backups, desktop release assets, transient attachments) | Everything stored by Statio — account data, org data, extracted document fields, database backups | EU/EEA — no transfer |
| 2 | Mistral AI | Mistral AI SAS (France) | All LLM inference — chat, classification, extraction, translation, drafting — and, since PLAN-161/ADR-064, server-side OCR (Document AI) and, since PLAN-165, speech-to-text for dictation and text-to-speech for spoken answers | Whatever the customer or an automation sends into a prompt: message text, document/email content being extracted, org context. Plus, for OCR: the raw bytes of the document being read (a PDF/image invoice, receipt, or POS Z-report) — sent in-memory, never stored by Statio. For mailbox attachments this is the server-side default. For documents on the customer's own computer (watched folders, files the user picks) the text is read locally — PDF text layers and images never leave the machine — and only a scanned document with no text layer is sent here, and only when the desktop is in assisted OCR mode and the user has consented (default: local-only, PLAN-167). The Document Vault is excluded: it is OCR'd and embedded locally on the customer's machine and never reaches Mistral. For watched folders (desk awareness, PLAN-167, opt-in): the extracted card fields, and — only when the local classifier cannot decide, and only after the local personal-data check passed — a text snippet of at most 2 000 characters; never the file, never file names of skipped documents, never clipboard contents. For contract review (user-triggered): the first two pages plus the passages around locally found clauses, never during indexing. Plus, for voice: short voice clips you dictate (max 90 s, mono), transcribed in memory and discarded; and the text of a reply you ask to hear, sent for speech synthesis. | EU/EEA — no transfer |
| 3 | Stripe | Stripe Payments Europe Ltd (Ireland), with Stripe Inc. (US) as onward processor | Subscription billing, payment processing, invoicing | Billing contact, company name, VAT ID, payment method, subscription state. Not customer business content | EU entity; SCCs cover the US onward transfer (Stripe's own DPA) |
| 4 | Resend | Resend, Inc. (United States) | Outbound transactional email — reports, invitations, weekly briefing, notifications | Recipient email address, recipient name, and the report/briefing body (which may contain extracted financial figures) | US — Standard Contractual Clauses + a transfer impact assessment |
| 5 | GitLab | GitLab Inc. (United States) | Source control and CI/CD only | No customer data. Build artefacts and secrets, never production data | US — no customer personal data flows here, so no transfer mechanism needed |
Conditionally active — not currently a sub-processor
| Sub-processor | Status | Trigger that would activate it |
|---|---|---|
| Sentry | Dependency present, currently inert. @sentry/react initialises only if VITE_SENTRY_DSN is set, and no DSN is configured today (apps/statio-desktop/src/main.tsx:8). @sentry/nextjs is in statio-web's dependencies with no init call. | The moment a DSN is configured, Sentry becomes a live sub-processor receiving error payloads that can contain user context. Add it to Annex B1 before setting the DSN, not after. |
Parked — do NOT list (ADR-063)
GoCardless (PSD2 bank data), Storecove (Peppol access point) and Mailgun (inbound email) all appear in the codebase but are inert and parked. They must not be listed as sub-processors while no credentials exist. If any is ever revived, it re-enters Annex B1 before the first live call.
Annex B2 — Customer-directed integrations (for transparency, not sub-processors)
Statio connects to these only when the customer enables the corresponding Statio App and supplies their own credentials. Statio is acting on the customer's documented instruction; the customer's relationship is with the provider.
Accounting: Exact Online, e-Boekhouden, Jortt, Moneybird, Twinfield (unlisted). Mail & calendar: Google (Gmail, Calendar), Microsoft 365 (Graph). Payments: Mollie. E-commerce: Shopify, WooCommerce, bol.com. Business registers (lookup only): VIES / European Commission, KVK. Reference data (no personal data sent): European Central Bank FX rates.
Change log
| Date | Change |
|---|---|
| 2026-08-03 | Initial draft compiled from the codebase. Not yet lawyer-reviewed, not yet published. |
| 2026-08-10 | Published at /legal/sub-processors. No change to the list itself. |
| 2026-09-06 | Row 2 (Mistral AI) expanded: server-side OCR of mailbox attachments (Document AI), speech-to-text and text-to-speech for voice, desk-awareness classification snippets and contract-review passages. Parked providers named explicitly so they cannot be mistaken for live sub-processors. No provider added or removed. |