Kountr engages the sub-processors below to deliver the Service. Each is bound by a written agreement that includes confidentiality, security, and (where personal data is processed) data-protection terms aligned with PIPEDA, Quebec Law 25, GDPR/UK GDPR (where applicable), and CCPA/CPRA.
We update this page when we add or replace a sub-processor, and we notify account holders by email of material additions — a new vendor that will process your financial records or personal information — unless a faster change is needed for security or service continuity.
| Vendor | Purpose | Region | Data processed |
|---|
| Supabase | Application database and storage of files you upload | Canada Central (ca-central-1) | All Service data — accounts, transactions, ledger, receipts, contracts — encrypted at rest |
| Render | Hosting for the Kountr API server | United States (Virginia) | Service data in transit through the API, plus server logs |
| Netlify | Hosting and CDN for the web app and marketing site | Global edge (US-headquartered) | Request metadata for static assets; no ledger data |
| Firebase Authentication (Google) | Sign-in, password reset, email verification | United States | Email address, password credential, auth tokens, sign-in metadata |
| Plaid Inc. | Bank connectivity, transaction & balance sync | United States | Account holder name, institution, account type, masked account number, balances, transactions. No banking credentials, no full account or routing numbers. |
| Stripe | Subscription billing & payment processing | United States | Billing contact, card token, card brand + last 4, invoices, subscription status |
| Anthropic (Claude API) | AI document reading (receipts, bills of sale) and categorization suggestions | United States | Uploaded document images/PDFs and their text, transaction descriptions and amounts, vendor names, your category list. No credentials, no full card numbers. Not used to train models. |
| Resend | Transactional and account email delivery | United States | Recipient email address, message content |
| Telegram | Optional receipt-forwarding bot — only if you link it | International | Photos/documents you send the bot, message metadata, your Telegram user ID and username |
| PostHog | First-party product analytics | United States (us.i.posthog.com) | Device and feature-usage events, IP, page views. No transaction amounts or ledger data. |
Where your data actually sits
Your application database and every file you upload are stored in Canada (Supabase, Canada Central). The API server that reads and writes them runs in the United States (Render, Virginia), as do AI processing, payments, bank connectivity, authentication, email, and analytics. So your personal information is processed outside Canada and, while it is there, is subject to the laws of that jurisdiction, including lawful access by US authorities. See Privacy Policy §7.
Where a transfer is subject to the GDPR or UK GDPR, Kountr relies on contractual safeguards including, where required, the EU Standard Contractual Clauses and the UK Addendum.
Subscribe to updates
To receive sub-processor change notifications, email info@kountrfi.ca with the subject “Subscribe — Sub-processor updates.”
Hejazi Technology Inc. · Ontario, Canada
