Legal
Subprocessors
The companies that process data on AnyStatement’s behalf, what each one does, and what it receives.
Last updated , See what changed, 2 min read
Current subprocessors
| Company | What it does | Data it receives |
|---|---|---|
| Amazon Web Services, Inc.United States (us-east-1; AI requests stay within US regions) | Runs the conversion service: file storage, database, processing, OCR (Amazon Textract) and AI (Amazon Bedrock), logs and encryption keys. | Uploaded statements and their results; account data (email, plan, usage); hashed client identifiers; operational logs without document content. |
| Vercel Inc.United States; pages delivered from Vercel’s global network | Hosts the website and the sign-in step. | Website requests, including IP address and browser details; the encrypted sign-in session cookie (your name and email from WorkOS). Never documents. |
| WorkOS, Inc.United States | Sign-in and account authentication, on WorkOS’s hosted sign-in page (email and password, or Google). | Email address, name, sign-in method (for example your Google account), and the IP address and device of sign-ins. |
| Stripe, Inc.United States | Payments, subscriptions, invoices and sales tax. | Email address, internal account ID, card details (entered directly with Stripe), billing address, purchase history, and device data for fraud prevention. |
| Namecheap, Inc.Provider-managed infrastructure; no regional restriction configured | Forwards messages sent to our support email address. | Sender and recipient email addresses, message content and any attachments. Not files uploaded through the app. |
| Google LLC (Gmail)Provider-managed infrastructure; no regional restriction configured | Stores the support inbox and handles support replies. | Support email addresses, message content and any attachments. Not files uploaded through the app. |
Services on WorkOS’s sign-in page
The sign-in page runs on WorkOS’s own domain, under WorkOS’s privacy policy. On it, WorkOS uses services of its own, which are WorkOS’s subprocessors rather than ours. They can see how you use the sign-in page; they never receive your statements.
- Datadog (United States): Real User Monitoring of the sign-in page: page views, interactions and performance (cookie _dd_s).
- Sentry (United States): Error reports from the sign-in page.
- Cloudflare (Global network): Bot protection for the sign-in page (cookies __cf_bm and _cfuvid).
WorkOS publishes its full list at workos.com/legal/subprocessors.
Who doesn’t receive your data
No analytics, advertising or tracking company receives anything from AnyStatement. Your documents go to AWS only: the makers of the AI model used through Amazon Bedrock never receive them, and nothing is used to train AI models.
If you sign in with Google, Google shares your name and email with WorkOS under its own privacy policy, at your choice.
Changes
We give at least 30 days’ notice before a new subprocessor starts processing personal data: by email to account holders, and in the policy change history. You may object by writing to support@anystatement.com; if we can’t resolve your objection, you can delete your account. Businesses can review our draft Data Processing Addendum. How we handle data overall is in the Privacy Policy.