Subprocessors
Every service provider that touches your data is on this list
We rely on specialist service providers for parts of running the platform. Below we list each one's purpose, the data it processes and its location. Before adding a new subprocessor, we give our tenants 30 days' notice.
Send a requestPlatform subprocessors
Location shows where data is processed or where the provider is headquartered. Every location outside Türkiye is a cross-border transfer under KVKK Article 9.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner | Server, storage and backup hosting | All tenant data on the platform | Germany |
| Cloudflare | DNS, content delivery, DDoS protection, firewall, TLS | IP address, request details, traffic in transit | Global edge network, headquartered in the US |
| Mailgun | Transactional email (notifications, sign-in codes, reconciliation letters) | Recipient name and email, email content | Headquartered in the US |
| Turkcell e-Dönüşüm | E-invoice and e-archive transmission (tenants using the built-in service) | Invoice content, buyer name and tax number | Türkiye |
| NETGSM | SMS delivery (sign-in codes, reminders) | Phone number, message content | Türkiye |
| Sentry | Application error monitoring | Error record, technical context, user ID; a masked session replay may be captured when an error occurs | Headquartered in the US |
| Anthropic | AI model (assistants, document reading) | Records relevant to the question and document content; accessed through the contracted API, not used for model training | United States |
Access to the AI model
We access the AI model through the provider’s API under contract. Under that contract, data sent to the model is not used for model training.
Services that receive no personal data
Some services supply data to the platform but receive no personal data from us, so they are not subprocessors. For example, we get exchange rate data from CollectAPI; no personal data is sent to that service.
Services the tenant connects
The services below only run if you connect them. Credentials are stored encrypted with AES-256-GCM; data goes to these providers during an action you start.
| Service | Purpose | Data sent |
|---|---|---|
| İmzala | E-signing the contract when a proposal is accepted | Signer name, contact details, contract document |
| PayTR | Accepting online payments | Payment amount, customer name and contact details |
| Paraşüt | Sending invoice and account records to your Paraşüt account | Invoice, account and amount details |
| Your own e-invoice integrator | E-invoice and e-archive transmission if you connect your own integrator instead of the built-in service | Invoice content, buyer name and tax number |
| WhatsApp and Chatwoot | Inbox conversations | Message metadata and preview |
If you do not connect one of these services, the related task either runs on the platform’s own infrastructure or does not run; connecting them is optional.
Change notification
When a new subprocessor is added, or the scope of data an existing one processes expands:
- The change is announced at least 30 days in advance on this page and by email to tenant administrators.
- Tenants with a data processing agreement can send a reasoned objection through the contact page within that period.
- For changes made for urgent security reasons, notice is given as soon as possible, together with the reason.
Frequently asked questions
Will I be told if a new subprocessor is added?
Yes. We announce a new subprocessor to tenants by email and on this page at least 30 days before it goes live. Tenants with a data processing agreement may raise a reasoned objection within that period.
Why are the services I connect myself not on this list?
Accounts such as e-signature, online payments, accounting export, WhatsApp and the inbox are connected by you, and you choose which provider to work with. That relationship is between you and them; we list them separately below.
Do you have contracts with subprocessors?
Yes. Each subprocessor is bound by contract terms consistent with the data protection obligations we take on towards you.
Does the AI provider store my data?
The model provider processes data only to answer the request and, by contract, does not use it for model training. Limited retention for abuse monitoring is subject to the provider's terms.
Related
Trust Center →
Security, KVKK and GDPR, subprocessors, backups and the compliance roadmap in one place.
KVKK and GDPR →
Data subject rights, how to apply, cross-border transfer and AI processing.
Data Processing →
Controller and processor roles, data categories per module and retention.
Security →
Infrastructure, tenant isolation, encryption, access control and audit trail.
Integrations →
Your email, SMS, e-signature, payment and messaging accounts, connected and encrypted.
Let us attach the subprocessor list to your contract
We send the current list as an annex together with your data processing agreement request.
Send a request