Last updated: October 6, 2026
This page lists all sub-processors that Walletguide GmbH engages to process customer data when providing the SaaSFlow services, as referenced in our Data Processing Agreement. We announce additions or replacements on this page and inform account owners by email at least 14 days before a new sub-processor starts processing customer data. A customer who does not agree with a change can object until then and terminate the contract with effect from that date; we refund fees already paid on a pro-rata basis (§ 5 of the Data Processing Agreement).
Internal business tools that are not part of the services, such as our own email and collaboration environment or our development tooling, are not sub-processors and are not listed here. They do not process the customer data the services hold on your behalf. Where such a provider processes personal data for which we are the controller, for example your contact details in an email to our support address, a data processing agreement is in place with it as well, and our privacy policy describes that processing.
Google Cloud Platform
Hosting of our server infrastructure, database and file storage, including storing of encrypted and unencrypted data of our customers. Also the AI processing behind our AI features, through Google's Vertex AI service: Anthropic's Claude models for the monthly performance report, the report chat and categorization suggestions, and Google's Gemini models for reading uploaded documents and suggesting mappings for connected tools (Finway, Pleo). Google Cloud runs these models itself, in EU data centers. Anthropic does not receive any customer data.
Country: EU (hosting and database in Germany, Frankfurt region europe-west3; AI processing in the EU through Vertex AI's EU endpoints)
Customer data type: User info (email, name, contact info), Customer data
Safeguards: EU Model Clauses
Data protection officer: Keith Enright (Director, Privacy Legal)
Contact details: Link
Data processing terms: Link
Amazon Web Services (AWS European Sovereign Cloud)
Email delivery (e.g., notifications, reports, invitations, sign-in emails) and receiving the documents you email to your company's SaaSFlow inbox address. We use the AWS European Sovereign Cloud, a separate AWS cloud that is operated from the EU and keeps customer content in the EU.
Country: EU (contracting entity: Amazon Web Services EMEA SARL, Luxembourg; data held in Germany, region eusc-de-east-1 in Brandenburg, operated by Amazon Data Services European Sovereign Cloud GmbH)
Customer data type: User info (email, name), contents and attachments of emails sent to the inbox address
Safeguards: Processing within the EU (AWS European Sovereign Cloud Addendum and its data processing addendum)
Data protection officer: aws-EU-privacy@amazon.com
Contact details: Link
Data processing terms: Link
Stripe
Payment processing for SaaSFlow subscriptions
Country: US (EU contracting entity: Stripe Payments Europe Ltd., Ireland)
Customer data type: Billing contact info and payment data
Safeguards: EU Model Clauses
Data protection officer: dpo@stripe.com
Contact details: Link
Data processing terms: Link
Bank connectivity providers
The following providers are not sub-processors. We list them here so you can see every company that handles your bank data when you use SaaSFlow.
Connecting a bank account is your choice. You can also add accounts manually and keep them current with CSV imports, in which case neither provider is involved. If you connect an account automatically, you authorize the provider yourself: in its own window, under its own terms and privacy policy. The provider signs in to your bank, retrieves the account and transaction data, and passes it to SaaSFlow on your instruction. For that access it acts as an independent controller under its own legal obligations, not on our behalf and not on our instructions. The only thing we send it is a pseudonymous technical ID so it can assign the connection to your account. Once the data has arrived in SaaSFlow, we process it as your processor under the Data Processing Agreement.
Because these providers are not sub-processors, the notice and objection procedure in § 5 of the Data Processing Agreement does not apply to them. We still announce changes to this section on this page.
finAPI
Account information service for bank accounts in Europe, licensed by the German Federal Financial Supervisory Authority (BaFin)
Country: EU (Germany)
Data: Bank account and transaction data of the accounts you connect
Terms and privacy policy: shown in the finAPI window when you connect an account; privacy policy here
Plaid
Bank connectivity for bank accounts in the United States and Canada
Country: US (Plaid Inc.)
Data: Bank account and transaction data of the accounts you connect
Terms and privacy policy: shown in the Plaid window when you connect an account; privacy policy here