Sub-processors
Last updated: October 2, 2026
These are the third parties that process personal data for Incusia. Incusia is the controller for account data and the processor for the client data you upload. See the Privacy Policy and the Data Processing Agreement.
This list is kept current. If a provider is added or replaced, or if the kind of data it receives changes, we will update this page and email account holders before the change, or as soon as we can when the change is not ours to schedule.
Current list
| Service | Used for | Data | Where it processes data |
|---|---|---|---|
| Supabase | Database, authentication, and file storage for logos and expense receipts. | Account data, and the client, invoice, estimate, time, and expense data you enter. Passwords are stored as hashes. | Not stated here. The project URL does not include a region, and the response headers we checked did not either. A Cloudflare edge in Oslo only shows where that request entered Cloudflare, not where the database lives. |
| Vercel | Application hosting, the CDN, and Vercel Web Analytics page views. | Pages you request, and the account and client data included in a request while the app handles it. Web Analytics sees page views, not invoice contents. | On 2 October 2026 the production function region in the x-vercel-id header was iad1, Washington, D.C., United States. The edge for that check was arn1, Stockholm. The edge changes with the visitor. |
| Resend | Transactional email: invoices, reminders, receipts, and account notices. | Recipient email addresses, and the message content, which can include invoice details. | Not confirmed for this account. The region is omitted rather than guessed. |
| Stripe | Incusia subscription billing, and Stripe Connect when you let a client pay an invoice. | Your billing email and subscription. Client card numbers go to Stripe and are not stored on Incusia servers. Incusia stores Stripe ids. | Not confirmed as a single region. Stripe publishes its own processing locations. |
| Google Analytics | Usage analytics, and only after the cookie banner is accepted. | Pages and clicks. Not your name, client list, or invoice contents. | Google. The product does not pin analytics to one country. |
Any questions? Send an email to me@abassinvoice.com and I will get back to you within 24 hours.