Closebook · Legal
Sub-processors
The complete list of vendors that can reach Closebook customer data, what each is for, and where it processes. Three are always used; one is used only by the AI mapping assistant.
Last updated 10 September 2026
Vendors we always use
These three are load-bearing: Closebook cannot run without them, so every workspace's data is processed by all three.
| Vendor | Purpose | Data it can reach | Where |
|---|---|---|---|
| Vercel | Application hosting, serverless functions and scheduled jobs | Everything that passes through a request: account data, workspace content in transit, server logs | Frankfurt, European Union (Vercel, region fra1) |
| Supabase | Postgres database, authentication and file storage | All workspace content at rest, account records, encrypted connector credentials, uploaded statement files | Frankfurt, European Union (Supabase, eu-central-1) |
| Resend | Transactional email — sign-in mail, notifications, replies to demo requests | Name and email address, and the contents of the message being sent | United States |
Vendors used only for a specific feature
The AI mapping assistant is the only feature that sends data outside the three vendors above, and only when a person in your workspace asks for a suggestion. Every suggestion is approved by a person before it changes a record, and we can disable the assistant for your workspace on request.
| Vendor | Purpose | Data it can reach | Where |
|---|---|---|---|
| Google (Gemini) | The AI mapping assistant — proposing a category for a transaction when a person asks it to | The description and amount of the specific transactions being classified. Not your ledger, not your account data | United States |
We use the provider under terms that prohibit training on our submissions. Closebook selects the first provider whose credentials are configured, so this row names the one in use for production.
Things that look like sub-processors but are not
- Google Fonts. Serves the two typefaces the interface uses. Your browser requests them directly and Google may log the requesting IP address, as with any font request. No customer data is sent.
- Stripe, Mercury, HubSpot, Upwork, Paraşüt and your banks. These are sources you choose to connect. Closebook reads from them on your instruction; they are your providers, not our sub-processors, and disconnecting one stops the flow immediately.
We include this section because security reviews routinely ask about all of the above, and the honest answer is a distinction rather than a yes or no.
What each one is bound to
Every sub-processor is engaged under a written contract that limits it to processing on our instructions, requires confidentiality and appropriate security, and — where personal data leaves the EEA, UK or Switzerland — incorporates the European Commission's Standard Contractual Clauses with the UK Addendum where relevant.
We stay responsible to you for what a sub-processor does with your data. The data processing addendum sets out that chain formally.
Changes to this list
We will update this page before a new sub-processor starts handling customer data, and workspace owners are emailed at least thirty days ahead of a material addition, so there is time to object. To be notified of changes, or to object to one, write to privacy@vizio.ai.