BookkeepLedgerLegal
Subprocessors
Subprocessors are companies that process personal information for us so we can run BookkeepLedger. Each one is bound by a contract that limits what it can do with the data. We'll update this page before we add a new subprocessor.
In use
| Company | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. Privacy · Data processing | Hosting: Postgres database, Redis cache and job queue, S3 file storage for receipts and statements, application servers and web hosting | All data in BookkeepLedger | United States (US East, N. Virginia) |
| Amazon Web Services, Inc.: Amazon Cognito | Sign-in, password storage, required two-step sign-in, sign-up and password-reset emails | Name, email, password, authenticator setup | United States |
| Amazon Web Services, Inc.: Amazon Bedrock Data protection | Runs the Claude AI models behind the desk, category suggestions, and receipt and statement reading | The parts of a company's books, uploaded files and questions needed for each AI request | United States |
| Amazon Web Services, Inc.: Amazon SES | Sends app email: invitations, invoices, payment reminders, scheduled reports, collection emails a user approves, sign-in codes and security notices | Recipient name and email address, email content, invoice PDFs | United States |
| Plaid Inc. End User Privacy Policy | Connects bank and credit card accounts and brings in balances and transactions | Bank account details (name, type, last 4 digits), balances, transactions | United States |
| Stripe, Inc. Privacy | Subscription billing (Checkout and billing portal); invoice payments for customers who turn on card payments (Stripe Connect) | Billing contact, subscription status, payment and payout records. Card data stays with Stripe. | United States |
| Cloudflare, Inc. Privacy | Hosts bookkeepledger.app, stores beta access requests, and runs the Turnstile spam check on the beta form | Name, email, company, role, bank and message from beta requests; a salted hash of the IP address | United States and Cloudflare's global network |
| 650 Industries, Inc. (Expo) Privacy | Delivers push notifications to the mobile app | Device push token, notification title and text, such as a merchant name and amount | United States |
Not subprocessors
- Speech-to-text for voice input runs on a service we host ourselves. Recordings aren't stored.
- Apple App Store and Google Play distribute the mobile apps. They don't receive data from BookkeepLedger.
Changes
| Date | Change |
|---|---|
| November 2, 2026 | Added Cloudflare for the website and beta requests |
| November 2, 2026 | First published |