Loading…
Subcontratantes · Subprocessors
Qui d'autre traite vos données
These are the companies that process client data on our behalf. Each one is engaged in writing, may only act on our documented instructions, and is required to impose the same duties on anyone it engages in turn.
Nous donnons au moins thirty days’ notice before adding or replacing any of them, and you may object on reasonable data-protection grounds within fifteen days. This is the list referred to in clause 5.5 of the Privacy Notice.
Last changed 4 August 2026
| Company | Ce qu'ils font | Ce qu'ils reçoivent | Where | Base de tout transfert |
|---|---|---|---|---|
| ContaboContabo GmbH, Germany | Server hosting: the application, the database, the document store and the worker. | All client data held by the platform, including uploaded documents. | Data centre in Germany. | No transfer outside the EEA. The company and the data centre are both in the EU. |
| CloudflareCloudflare, Inc. / Cloudflare Ireland Ltd | Delivery of the website and the client workspace, and protection against attack. | Requests to the site, including IP address. Application data passes through in transit. | Global edge network. | Standard Contractual Clauses, with Cloudflare's supplementary measures. |
| ResendResend, Inc. | Sending transactional email: verification, notices, receipts and reminders. | Email address, name, and the contents of the messages sent. | United States. | Standard Contractual Clauses. |
| StripeStripe Payments Europe, Ltd., Ireland | Taking subscription and one-off payments. | Billing details and payment status. Card details go to Stripe directly and are never held by Taxovate. | Ireland, with group processing in the United States. | Standard Contractual Clauses. |
| OpenAIOpenAI Ireland Ltd (for customers in the EEA) | AI-assisted classification, extraction and drafting, as described in the AI and Automated Processing Annex. | The document and financial content submitted for a given task. Portal credentials are never sent, and client data is not used to train models. | Ireland, with processing in the United States. | Data Processing Addendum with Standard Contractual Clauses. |
| Meta / WhatsAppWhatsApp Ireland Ltd | Messages with the client, where the client has chosen WhatsApp as a channel. | Phone number and the contents of those messages. | Ireland, with group processing in the United States. | Standard Contractual Clauses. Sensitive material is not sent over this channel. |
| SentryFunctional Software, Inc. | Reports of errors that happen in the visitor's browser. | Technical error detail. Request bodies are stripped and the user is reduced to an identifier before sending. | European region (Germany). | No transfer outside the EEA for stored data; EU data residency is in force. |
| PostHogPostHog, Inc. | Product analytics: which pages are used, and where people stop. | Page views and clicks. Form contents are not recorded. | European region (EU cloud). | EU data residency is in force; Standard Contractual Clauses for the provider. |
Hébergé sur nos propres serveurs, par personne d'autre
These are not subprocessors. They run on our own infrastructure, so no third party receives the data at all.
- KeycloakSign-in and account identity.
Runs on Taxovate's own server. No third party receives sign-in data.
- GlitchTipReports of errors that happen on the server.
Runs on Taxovate's own server, reachable only from it. Server errors are the place client data would otherwise reach an error-tracking vendor, and here they do not leave.
Deux choses que nous ne faisons jamais
- Portal credentials for Finanças or Segurança Social are never sent to any technology supplier, including AI suppliers.
- Les données des clients ne sont jamais vendues, ni utilisées pour entraîner des modèles d'IA.
Questions about any of this, or about your own data, go to clientes@taxovate.pt.