Your data
Subprocessors
The companies that process personal data on Kiaro's behalf. Each one has a data processing agreement with Kiaro.
Last updated: November 4, 2026
Providers that handle your workspace data
These providers process the data you store in Kiaro, including information about your clients.
Neon (Databricks, Inc.)
Database hosting
- Data
- All account and workspace data: clients, contacts, projects, tasks, time, invoices, proposals, contracts, notes
- Location
- EU (AWS Frankfurt)
- Transfers
- Stored in the EU. SCCs and EU-U.S. Data Privacy Framework for any support access from the US
Cloudflare, Inc. (R2)
File storage
- Data
- Files you upload and generated PDFs
- Location
- EU (R2 EU jurisdiction)
- Transfers
- Stored in the EU. SCCs and Data Privacy Framework for any access from outside the EU
Vercel, Inc.
Application hosting
- Data
- Request data, including IP addresses, passing through the app
- Location
- Runs in Frankfurt. Vercel's company and some platform operations are in the US
- Transfers
- SCCs and Data Privacy Framework
Resend, Inc.
Transactional email (invoices, portal links, sign-in, replies)
- Data
- Recipient names and email addresses, email content, delivery logs
- Location
- United States
- Transfers
- SCCs and Data Privacy Framework
Functional Software, Inc. (Sentry)
Error monitoring
- Data
- Technical error details, user and workspace IDs, browser and device type
- Location
- EU (Frankfurt). Sentry keeps account settings in the US
- Transfers
- SCCs and Data Privacy Framework
Upstash, Inc.
Rate limiting
- Data
- Short-lived request counters keyed by IP address, workspace ID or session ID
- Location
- Upstash is a US company
- Transfers
- Data Privacy Framework, with SCCs as fallback
Anthropic (Claude)
Built-in AI features
- Data
- The context needed for an AI request, only when you use an AI feature
- Location
- United States (contract with Anthropic Ireland, Ltd.)
- Transfers
- SCCs
OpenAI
Backup for built-in AI, used only when Anthropic is unavailable
- Data
- As for Anthropic, only for requests made during an outage
- Location
- United States (contract with OpenAI Ireland Ltd)
- Transfers
- SCCs
Google LLC (Gemini API)
Backup for the weekly digest, used only when Anthropic is unavailable
- Data
- Weekly digest context, only for requests made during an outage
- Location
- United States and other Google regions
- Transfers
- SCCs and Data Privacy Framework
Providers that handle account and website data only
These providers process data about you as a Kiaro account holder or about visitors to kiaro.io. They never receive your clients' data.
PostHog, Inc.
Product analytics
- Data
- Usage events, user and workspace IDs, plan. No client names or business content
- Location
- EU (Frankfurt)
- Transfers
- Stored in the EU. SCCs and Data Privacy Framework
Loops (Astrodon Corporation)
Account and lifecycle email
- Data
- Your email address, first name, user and workspace IDs, plan and trial dates
- Location
- United States
- Transfers
- Data Privacy Framework
Cloudflare, Inc. (Turnstile)
Bot protection on sign-up and public forms
- Data
- IP address and browser signals
- Location
- Cloudflare's global network
- Transfers
- SCCs and Data Privacy Framework
Trustpilot A/S
Review invitations after you start a paid plan
- Data
- Your email address and name
- Location
- Denmark (EU)
- Transfers
- Stored in the EU
Google LLC (Analytics, Ads)
Marketing site measurement, only after you accept cookies
- Data
- Page visits, IP address, browser, a hashed email at sign-up if you accept advertising cookies
- Location
- United States
- Transfers
- SCCs and Data Privacy Framework
Contentsquare SAS
Marketing site analytics, only after you accept cookies
- Data
- Page views, scrolls and clicks on kiaro.io
- Location
- France (EU), with processing by its own subprocessors
- Transfers
- SCCs and Data Privacy Framework
Not subprocessors
- Lemon Squeezy is the merchant of record that sells you your Kiaro subscription. It handles your payment details under its own terms and privacy policy.
- Stripe processes your clients' invoice payments on your own connected Stripe account, under your agreement with Stripe. Stripe also uses payment data for its own fraud prevention and legal compliance.
- Xero and AI apps you connect yourself, such as Claude or ChatGPT, receive data because you send it to them. They process it under your own account and agreement with that provider.
- Cloudflare Turnstile also uses bot-check signals to improve its own bot detection, as an independent controller.
Changes to this list
We announce a new subprocessor at least 30 days before it starts processing your workspace data. Email hello@kiaro.io to be told about changes.
- November 4, 2026: First published list.
See also the privacy policy and security pages.