Sub-processors
Last updated 12 October 2026. Every third party that touches customer data, what it does, and where it is. We give 30 days’ notice before adding one.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Anthropic, PBC San Francisco, USA | Claude AI models that read documents and draft classifications, checks and quote replies. | Document content (text and images), prompts, and the draft outputs. | United States | Anthropic Commercial Terms: no training on customer data, confidentiality, API data deleted within 30 days; SOC 2 Type II and ISO 27001 certified; trust centre. |
| Hostinger International Ltd Cyprus, with affiliates | Hosting of the Tariffly application, database, uploaded documents and backups. | All workspace data: accounts, documents, drafts, activity log. | Data centre region published on the Security page | Data processing agreement with EU standard contractual clauses; ISO 27001 data centres; documents stored outside the web root. |
| Stripe Payments Australia Pty Ltd with Stripe, Inc. and Stripe Payments Europe Ltd | Card payments, invoices, the billing portal. | Billing name, email, company, plan, card details (collected directly by Stripe; never stored by us). | Australia, United States, Ireland | PCI DSS Level 1; Stripe services agreement. Only used when you choose to pay by card. |
| Email delivery (Hostinger Email) | Sending service emails (review alerts, intake confirmations, password resets) and receiving documents sent to intake addresses. | Names, email addresses, subject lines, message text and attachments sent to an intake address. | As Hostinger above | TLS in transit; intake mailbox polled over encrypted IMAP; attachments moved into workspace storage and not kept in the mailbox longer than needed. |
| Google Fonts | Web fonts on public pages and in the app. | IP address and browser details of the request only. | Global | No cookies set by Google Fonts; no customer content involved. |
Not used
We do not use advertising networks, tracking pixels, session-recording tools, data brokers or offshore support contractors. Our own founders, in Australia and Bangladesh, are the only people with administrative access, and that access is logged.
Changes
We will update this page and email workspace owners at least 30 days before a new sub-processor handles customer data. If you object on reasonable grounds related to data protection, you may terminate your subscription before the change takes effect and receive a pro-rata refund of prepaid fees. Questions: iahnaf210@gmail.com.