Trust
Sub-Processors
Last updated:
To deliver IntBooks we engage trusted sub-processors who handle customer data on our behalf under written data-processing terms. This page is published as a transparency commitment and as input for enterprise vendor-risk reviews. We notify account admins by email at least 30 days before adding a new sub-processor that processes customer data.
| Vendor | Service | Scope of data | Region |
|---|---|---|---|
| Hetzner Cloud | Server hosting for the IntBooks application and its PostgreSQL database (open-source Supabase stack operated by IntBooks) | All customer business data and uploaded files (invoices, journal entries, payroll, documents); application runtime | Singapore |
| Cloudflare | CDN, DDoS protection, edge gateway, WAF, marketing-site hosting (Workers) | Inbound HTTPS traffic, edge cache, server-side request logs (IP, URL, UA) up to 30 days | Global anycast |
| Cloudflare Workers AI | Marketing-site chatbot inference (Meta Llama 3.3-70B) | Chatbot user messages — processed transiently, not persisted by IntBooks. Do not paste personal data into the chatbot. | Cloudflare global network |
| Cloudflare Workers KV | Optional append-only log of marketing waitlist signups | Waitlist submission payload (email, role, industry, revenue band, UTM tags); 12-month TTL | Cloudflare global network |
| Clerk | Identity, authentication, session management | User account metadata and session tokens | United States (data-residency upgrade available) |
| Stripe | Payment processing (cards, recurring billing) | Payment method, billing address, plan/invoice IDs (no full card numbers) | Global (PCI DSS Level 1) |
| BillPlz | Local Malaysian payment processing (FPX, e-wallets) | Payment status, plan/invoice IDs | Malaysia |
| Resend | Transactional email delivery (in-app + marketing-site forms) | Recipient email + email content. Receives waitlist submissions (email, role, industry, revenue, IP, UA), services-contact submissions (name, email, phone, company, message), and ERP transactional mail (invoice notifications, password resets). Optional Resend Audience sync stores waitlist email + locale + UTM tags for closed-beta segmentation. | United States |
| Anthropic (Claude) | Receipt extraction + in-app AI assistant | Receipt images and prompts you submit. Inputs are NOT used to train Anthropic models. | United States |
| Google (Gemini, Cloud Vision) | Fallback provider for the in-app AI assistant and document text recognition | Prompts and document images you submit when these features route to Google. Named in the privacy policy (AI and your data). | Global |
| LHDN MyInvois | Malaysian e-invoice clearance (regulator-mandated) | Invoice headers and line items submitted for validation | Malaysia (LHDN data centre) |
Data Processing Agreement (DPA)
Business customers can request an executable DPA that incorporates this list by reference and includes the EU Standard Contractual Clauses (SCCs) where required. Request a copy from hello@intbooks.my.