Legal

Sub-processors

Everyone who touches data on our behalf, what they do, and where they hold it. Four names, and a list of what is deliberately absent.

Last updated 8 September 2026 · [SCORP LEGAL NAME — e.g. S Corp Accounting & Tax Consultancy L.L.C]

These are every third party that may handle data on our behalf. We give 30 days' notice by email before adding or replacing one — see clause 4 of the DPA for your right to object.

Who	What they do for us	Where the data sits
Supabase on Amazon Web Services	The database, authentication and file storage. Everything you enter lives here.	Mumbai, India (AWS ap-south-1)
Netlify	Serves the website and the application itself. The application runs in your browser; Netlify delivers the file and does not receive your client data.	Global edge network
Stripe	Takes payment, holds card details and issues invoices. Receives your firm's billing name, address, email and TRN — never your clients' data.	United States and Ireland
[EMAIL PROVIDER — e.g. Resend]	Sends invitations, password resets and receipts. Receives the recipient's email address and the message.	[REGION]

What is deliberately not on this list

No analytics that follow individuals. We measure how the product is used in aggregate, in our own database, not through a third-party tracker.
No advertising networks. None, anywhere on the site or in the application.
No AI model provider. Your clients' data is not sent to any model, ours or anyone else's, and is not used for training.
No offshore support desk. Support is answered by the people who built it, in Dubai.

Getting told when this changes

Every workspace owner and administrator is emailed 30 days before this list changes. If you would like someone else at your firm on that notification, email privacy@accountive.ae and we will add them.