Subprocessors
Who else touches your data
VatForge uses a small number of service providers to operate and deliver the service. Each one below was verified as active against our codebase and infrastructure on September 14, 2026. Core customer data is hosted in the European Union.
List last reviewed September 14, 2026
Current subprocessors
Supabase
- Purpose
- Database, authentication and backend services (Edge Functions)
- Location
- European Union (Ireland, eu-west-1)
- SCCs / adequacy
- EU processing — no third-country transfer
Stripe
- Purpose
- Payment processing for VatForge subscriptions; read-only transaction imports for connected accounts
- Location
- Ireland / United States
- SCCs / adequacy
- EU–US Data Privacy Framework + Standard Contractual Clauses
Vatstack
- Purpose
- EU VAT rate reference data for the daily rate sync. Receives country-code queries only — no customer personal data is sent
- Location
- European Union (Austria)
- SCCs / adequacy
- EU processing — no third-country transfer
Resend
- Purpose
- Transactional and service-related email
- Location
- European Union
- SCCs / adequacy
- EU processing — no third-country transfer
Lovable
- Purpose
- Application hosting and site delivery
- Location
- European Union + CDN edge network
- SCCs / adequacy
- EU processing — no third-country transfer
Amazon Web Services (Route 53)
- Purpose
- DNS resolution for vatforge.com and vatforge.eu
- Location
- United States (global anycast network)
- SCCs / adequacy
- EU–US Data Privacy Framework + Standard Contractual Clauses
Plausible
- Purpose
- Privacy-friendly website analytics (cookieless, aggregate only — no personal data collected)
- Location
- European Union
- SCCs / adequacy
- EU processing — no third-country transfer
Google LLC (Google Analytics 4)
- Purpose
- Aggregate, pseudonymous site-usage analytics — funnel conversion, UTM attribution and revenue attribution. Consent-gated under Consent Mode v2: in the EEA, analytics and ad storage default to denied and no data is sent until the visitor accepts analytics cookies via our banner. Data categories: pseudonymous client_id (from the _ga cookie), page URLs, event names and UTM parameters — no name, no email, no account user_id; IP addresses are not stored (used transiently for coarse geolocation, then discarded). Retention: 14 months (GA4 data retention).
- Location
- United States (EU visitors' data transferred under the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses)
- SCCs / adequacy
- EU-US Data Privacy Framework + SCCs; consent-gated (Consent Mode v2)
Zoho
- Purpose
- Business email hosting for hello@vatforge.com and khumakh@vatforge.com; receives customer support and general inquiry emails, which may contain personal data (name, email address, account references).
- Location
- European Union (Zoho EU data center)
- SCCs / adequacy
- EU processing — no third-country transfer
Connected platforms
VatForge can import transaction or revenue information from supported third-party platforms selected by the customer. These currently include:
Stripe · Lemon Squeezy · Gumroad · Patreon · Substack (CSV import)
Connected platforms are not necessarily VatForge subprocessors. Their role depends on the relevant processing relationship and the services the customer has independently established with that platform. Stripe appears in the table above only because it processes VatForge subscription payments.
VatForge uses customer-authorized read-only connections (or, for Substack, customer-provided CSV files) to retrieve the information required to provide VAT compliance functionality.
AI and MCP connections
VatForge supports customer-initiated connections to compatible AI clients through MCP (Model Context Protocol).
VatForge does not automatically send customer VAT data to third-party AI providers. Access through MCP requires customer authorization and is initiated through the customer's chosen AI client. See our agent integrations page for setup details.
Customers should review the privacy and data-processing terms of any AI service they choose to connect.
International data transfers
VatForge keeps core customer data processing within the European Union.
Where personal data must be transferred outside the European Economic Area — currently limited to the US processing described in the table above — VatForge relies on the EU–US Data Privacy Framework and Standard Contractual Clauses as set out in our Data Processing Agreement.
Changes to subprocessors
Customers receive 30 days' advance notice of material additions or replacements to this list, as set out in our Data Processing Agreement, and may exercise the objection rights described there.
Change log
| Date | Change |
|---|---|
| 14 September 2026 | Google Analytics 4 added — consent-gated, pseudonymous site-usage analytics (US, DPF + SCCs). Sub-processor count 8 → 9. |
| 6 September 2026 | Zoho added for business email hosting (hello@vatforge.com and khumakh@vatforge.com). Zoho processes personal data in its EU data center; no third-country transfer applies. |
| 4 September 2026 | List cross-checked against codebase and infrastructure. Stripe, Vatstack and AWS Route 53 added; hosting region stated explicitly (Ireland, eu-west-1). No providers removed — Vercel was checked and is not used by VatForge. |
| 13 August 2026 | Initial subprocessor list published |
Questions
For questions about subprocessors, privacy or data protection, contact privacy@vatforge.com or see our Privacy Policy.