Sub-processors

Effective from: 28 September 2026

This text was prepared by DOXIO and has not yet been reviewed by an attorney. It reflects how the service actually works today; we will publish any change with a new effective date.

DOXIO uses the following sub-processors to provide the service. Each is bound by written data-processing terms, and we give at least 30 days' notice before adding or replacing one.

1. Where your data is processed

All production processing takes place in European Union regions: our application, database and object storage are hosted in the EU, transactional e-mail is sent from the EU, and error monitoring runs on PostHog's EU cloud. Some of these providers have parent companies outside the European Economic Area; where support access from a third country cannot be excluded, the transfer relies on the European Commission's Standard Contractual Clauses together with supplementary measures.

Mistral AI receives documents only from organizations whose owner has switched on the optional Document extraction module, and only the documents the organization chooses to extract. Mistral AI is a French company and processes them in the European Union.

2. Changes to this list

Before adding or replacing a sub-processor we update this page and e-mail the owner of every organization at least 30 days in advance. You may object on reasonable data-protection grounds as described in the Data Processing Agreement. Contact hello@doxio.pro for the current data-processing terms of any sub-processor.

Sub-processor	Purpose and data	Location
Railway	Railway Corp. (USA) — application hosting, PostgreSQL database and object storage for documents. Processes all Customer Data.	EU: application and database in the Netherlands (europe-west4), object storage in Amsterdam
Stripe	Stripe Payments Europe, Ltd. (Ireland) — payment processing and subscription billing. Processes billing contact details and payment data; no documents.	EU (Ireland), with group affiliates in the USA under Standard Contractual Clauses
Resend	Resend, Inc. (USA) — transactional e-mail delivery. Processes recipient e-mail addresses, names and the content of notification e-mails.	EU (eu-west-1, Ireland)
PostHog	PostHog, Inc. (USA) — server-side error monitoring. Receives error reports with personal data removed; no cookies, no scripts in the browser.	EU (eu.posthog.com, Frankfurt)
Mistral AI	Mistral AI SAS (Paris, France) — optional AI extraction of accounting documents (Document extraction). Processes the content of the invoices and receipts an organization chooses to extract, which may include personal data of its business partners. Used only if the organization's owner has switched the module on.	EU (France)

Railway
Railway Corp. (USA) — application hosting, PostgreSQL database and object storage for documents. Processes all Customer Data.
EU: application and database in the Netherlands (europe-west4), object storage in Amsterdam
Stripe
Stripe Payments Europe, Ltd. (Ireland) — payment processing and subscription billing. Processes billing contact details and payment data; no documents.
EU (Ireland), with group affiliates in the USA under Standard Contractual Clauses
Resend
Resend, Inc. (USA) — transactional e-mail delivery. Processes recipient e-mail addresses, names and the content of notification e-mails.
EU (eu-west-1, Ireland)
PostHog
PostHog, Inc. (USA) — server-side error monitoring. Receives error reports with personal data removed; no cookies, no scripts in the browser.
EU (eu.posthog.com, Frankfurt)
Mistral AI
Mistral AI SAS (Paris, France) — optional AI extraction of accounting documents (Document extraction). Processes the content of the invoices and receipts an organization chooses to extract, which may include personal data of its business partners. Used only if the organization's owner has switched the module on.
EU (France)