Subprocessors
List of subprocessors under Art. 28 GDPR · As of June 11, 2026
To provide the Dumpstera platform, we use carefully selected subprocessors. Contracts under Art. 28 GDPR are in place with all providers. Transfers to third countries take place exclusively on the basis of appropriate safeguards (in particular EU Standard Contractual Clauses).
| Provider | Purpose | Location | Data transfer |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, backend infrastructure | EU (Frankfurt, Germany) | Within the EU; for the US parent: EU Standard Contractual Clauses |
| Cloudflare, Inc. | Hosting, CDN, DDoS protection, edge computing | Global (EU edge preferred) | EU Standard Contractual Clauses (SCC), DPF-certified |
| Google Cloud EMEA Limited (Vertex AI — Gemini) | Server-side AI analysis and structured data extraction from uploaded invoices and email attachments. No customer data is used for model training (Vertex AI default). | EU (europe-west4, Netherlands) | Processed in the EU region; for any US parent access: EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Mailgun Technologies, Inc. | Receiving and sending transactional emails (invoice inbox, notifications) | EU (EU region) | EU Standard Contractual Clauses |
Notification of changes
We inform our customers of the addition or replacement of subprocessors with reasonable advance notice by email or by updating this page. Customers may object to intended changes within 30 days for important data protection reasons.
Contact
Questions about our subprocessors or the Data Processing Agreement: info@dumpstera.org