Finacra
Sub-processors
Last updated 2026-09-24
This is the complete list of third parties that process customer data on Finacra's behalf, or that customer data flows through during normal product operation. Material additions are notified to customers 30 days in advance via email + a banner on this page, per our Data Processing Agreement. To object before the change takes effect, email ibrahim@finacra.com.
Infrastructure
| Sub-processor | Status | Purpose | Region | Data | DPA |
|---|---|---|---|---|---|
| Vercel Inc. | In use | Application hosting + edge network (app.finacra.com, api.finacra.com, app.itr.finacra.com, www.finacra.com, itr.finacra.com) | United States (iad1 primary) | All request payloads in flight; nothing persisted beyond function lifetime. | Link |
| Supabase Inc. | In use | Postgres database (every customer record), object storage (Vault documents) | AWS Seoul (ap-northeast-2) | All persisted customer data. | Link |
| GitHub Inc. | In use | Source code + CI runners (no customer data) | United States | Source code only; CI builds run against synthetic fixtures. | Link |
AI / LLM providers
Every LLM endpoint we use is pinned to a zero-retention configuration (no prompt logging, no training). The router (OpenRouter) is configured to pass our zero-data-retention header to downstream providers.
| Sub-processor | Status | Purpose | Region | Data | DPA |
|---|---|---|---|---|---|
| OpenRouter Inc. | In use | LLM router for OCR + chat (Ask / Forecast / Critic / ITR canvas / vault classify) | Routes to provider endpoints in US / EU per model; all endpoints pin zero-retention | Per-request prompts. No training on prompts. No persistence beyond the response stream. | Link |
| Microsoft Corporation (Azure OpenAI) | In use | Structured extraction + embeddings (when routed via Azure) | East US 2 (Azure) | Per-request prompts. Microsoft no-training clause applies; 30-day abuse-monitoring buffer disabled on our subscription. | Link |
| Jina AI GmbH | In use Disclosed 20 September 2026. This vendor was in use before that date and should have been listed from the start — recorded here rather than backdated. | Text embeddings for Vault document search and the Ask agent’s retrieval | Germany (EU) | The TEXT of Vault document chunks and of the questions users type. Sent per request; not used for training. | Link |
| Perplexity AI Inc. | In use | Regulatory research (MCA / ICAI / CBDT lookups) via the Sonar API | United States | Per-request prompts (typically a CIN or statute reference; no customer PII). | Link |
| Anthropic PBC | In use | LLM endpoint for high-context reasoning, reached through OpenRouter | United States | Per-request prompts via OpenRouter (no logging when called with the zero-retention header). | Link |
Communications
| Sub-processor | Status | Purpose | Region | Data | DPA |
|---|---|---|---|---|---|
| Resend (Drei AI Inc.) | In use | Transactional email (magic-link sign-in, reminders, exports, deletion confirmations) | United States | Recipient email, sender domain, subject, body, delivery webhook events. | Link |
| Walkover Web Solutions Pvt Ltd (MSG91) | Not yet in use Adapter written; credentials are not set in production, so no phone number has been sent. Reminders on this channel are skipped with a reason rather than silently dropped. | SMS reminder delivery in India | India | Recipient phone number (E.164) and the reminder template variables. | Link |
| Meta Platforms Ireland Ltd (WhatsApp Business Cloud API) | Not yet in use Adapter written; credentials are not set in production, so no message has been sent. Disclosed before the channel goes live, which is the order the 30-day notice in our DPA requires. | WhatsApp reminder delivery | Ireland (EU) / United States | Recipient phone number, recipient name, and the template variables (requirement, period, due date). | Link |
Customer-authorised integrations (per-tenant OAuth)
These vendors aren't our processors in the strict sense — they're your books platforms, and the integration is opt-in per company. We list them here for transparency. You can disconnect any of these from the Integrations tab; tokens are deleted on disconnect.
| Sub-processor | Status | Purpose | Region | Data | DPA |
|---|---|---|---|---|---|
| Intuit Inc. (QuickBooks) | In use | Customer-authorised read of books data for compliance computation | United States | Per-customer OAuth-scoped access to invoices, bills, banking, contacts. Nothing is shared back beyond the OAuth round-trip. | Link |
| Zoho Corporation Pvt Ltd (Zoho Books + Zoho Payroll) | In use | Customer-authorised read of Zoho Books accounting data and Zoho Payroll payslip data | India + global (zoho.in / zoho.com and regional data centres) | Per-customer OAuth-scoped access to invoices, bills, banking, contacts, and — for Payroll — employee names, salary components and statutory deductions. | Link |
| Greytip Software Pvt Ltd (greytHR) | In use | Customer-authorised read of payroll runs and payslips | India | Per-customer API access to employee records, salary components and statutory deductions. | Link |
| Keka Technologies Pvt Ltd | In use | Customer-authorised read of payroll runs and payslips | India | Per-customer API access to employee records, salary components and statutory deductions. | Link |
| Razorpay Software Pvt Ltd (RazorpayX Payroll) | In use | Customer-authorised read of payroll runs and payslips — a separate integration from subscription billing below | India | Per-customer API access to employee records, salary components and statutory deductions. | Link |
| Busy Infotech Pvt Ltd (BusyNotify) | In use | Customer-authorised read of Busy accounting data | India | Per-customer API access to invoices, bills and ledgers. | Link |
| Marg ERP Ltd (MargBooks Cloud) | In use Split out from the old single "Marg ERP" row, which described the whole vendor as having no data flow. The cloud product does. | Customer-authorised read of MargBooks cloud accounting data | India | Per-customer API access to invoices, bills and ledgers. | Link |
| Razorpay Software Pvt Ltd (payments) | In use | Subscription billing + verification charges | India | Customer name, email, billing address, payment-method metadata (Razorpay holds card data, not Finacra). | Link |
| Tally Solutions Pvt Ltd | No data flow | Local desktop-agent bridge — the agent runs on the customer’s own machine | India (customer machine) | No vendor-side data flow; the agent is paired locally and talks only to Finacra. | N/A (no vendor data flow) |
| Marg ERP Ltd (desktop agent) | No data flow | Local desktop-agent bridge — the agent runs on the customer’s own machine | India (customer machine) | No vendor-side data flow. | N/A (no vendor data flow) |
| Zakat, Tax and Customs Authority (ZATCA / Fatoora) | In use | Saudi e-invoicing — clearance and reporting of the customer’s own invoices, at the customer’s instruction | Saudi Arabia | The invoice itself: seller, buyer, line items, VAT. This is a statutory filing, not a commercial sub-processor. | N/A (government authority, statutory filing) |
Ancillary
| Sub-processor | Status | Purpose | Region | Data | DPA |
|---|---|---|---|---|---|
| Google Ireland Ltd (Google Analytics 4) | In use Added 24 September 2026 with the tag itself, so the disclosure and the code land together. | Visitor measurement on the PUBLIC pages only: www.finacra.com, itr.finacra.com and app.itr.finacra.com | United States and Ireland | Page path, referrer, approximate location from IP, device and browser, and a first-party cookie id. No account, company or ledger data: the signed-in product at app.finacra.com does not load it, because its page paths carry company ids. | Link |
| Google LLC (Workspace + OAuth) | In use | Finacra-employee email/calendar; customer sign-in (OAuth identity only) | United States + EU (Google global) | Customer side: email + name only (OAuth profile + email scopes). Employee side: internal communications. | Link |
Change log
| Date | Change |
|---|---|
| 24 Sep 2026 | ADDED Google Analytics 4, which now runs on the public pages only (www.finacra.com, itr.finacra.com, app.itr.finacra.com). The signed-in product does not load it. The tag and this disclosure shipped in the same change. |
| 20 Sep 2026 | Corrected against the codebase. REMOVED Twilio, which was listed as a planned SMS provider and has never been called. ADDED Jina AI (embeddings — in use before this date and should have been listed from the start), MSG91 and Meta WhatsApp (adapters written, credentials not set, nothing sent), greytHR, Keka, RazorpayX Payroll and BusyNotify (payroll and books integrations already live), MargBooks Cloud (split from the desktop-agent row, which does have no data flow) and ZATCA. Zoho widened to name Zoho Payroll. The list is now generated from the code and checked against it, rather than kept by hand. |
| 25 Jun 2026 | Initial publication. |