Vendors and External Services

Last reviewed: 2026-10-25

These providers support the service, optional integrations, external content or development. Not every provider receives every user's data. Each entry describes the provider's role, the data involved and when it is used. Links to provider privacy notices offer further information about their data practices.

Amazon Web Services

Backend hosting, document storage, authentication, queues and Amazon Bedrock AI analysis.

Data involved: Account and authentication data, uploaded documents, extracted financial information and operational logs.
When used: Core infrastructure; AI analysis is used where required by document processing.
Processing location: Backend and document storage: Stockholm. Amazon Bedrock is configured to use EU regions.

Amazon Web Services privacy information

Vercel

Website hosting, content delivery, builds and Vercel Web Analytics.

Data involved: Web requests, IP addresses, device and page information, application responses and deployment logs.
When used: For website delivery and website usage statistics.
Processing location: Website functions: Stockholm and Frankfurt. Content delivery uses a global network.

Vercel privacy information

Neon

Managed PostgreSQL database.

Data involved: Account records, financial data, settings, payment references and support records stored by the application.
When used: For storing account records and financial data.

Neon privacy information

Stripe

Payments, checkout, refunds and billing.

Data involved: Customer contact and billing details, transaction metadata and payment details supplied to Stripe.
When used: When purchasing, managing a payment or requesting a refund.

Stripe privacy information

Brevo

Transactional email delivery.

Data involved: Recipient and sender addresses, message content and any included attachments.
When used: When the service sends account, support or administrative email.

Brevo privacy information

Opper

AI document classification and classification confidence checks.

Data involved: A truncated excerpt of document text, classification instructions and account-level service usage.
When used: For AI-assisted document classification.

Opper privacy information

Groq

Alternative AI document analysis.

Data involved: Document text and analysis instructions if this provider is selected.
When used: When selected for document analysis.

Groq privacy information

Sentry

Error reporting, performance traces, diagnostic logs and browser session replay.

Data involved: Error details, internal user identifiers, request metadata and masked replay data.
When used: For diagnosing errors and monitoring performance; browser replay is sampled.

Sentry privacy information

Mixpanel

Product usage analytics.

Data involved: Usage events, technical properties and hashed user identifiers. Names, email addresses and IP addresses are excluded from event and profile properties.
When used: Browser analytics follows performance-cookie consent. Also used for server-side usage events.
Processing location: EU service endpoint.

Mixpanel privacy information

PostHog

Feature flags, remote configuration and service access controls.

Data involved: Browser identifiers and request metadata. Feature checks do not include account identifiers.
When used: For feature configuration, with automatic event capture and session recording disabled.

PostHog privacy information

Slack

Support messages and operational notifications.

Data involved: Contact form contents, notification text and diagnostic context included in alerts.
When used: For support messages and operational alerts.

Slack privacy information

Bokio

Business bookkeeping and receipt synchronisation.

Data involved: Accounting entries and receipt documents, which may contain billing information.
When used: When synchronising bookkeeping entries and receipts.

Bokio privacy information

Google / YouTube

Google sign-in, authentication key retrieval, YouTube videos and thumbnails, and build-time fonts.

Data involved: Sign-in identifiers and tokens when used; browser IP and request metadata when loading media, thumbnails or profile images.
When used: Google sign-in is optional. YouTube thumbnails can load before playback; the player is loaded after interaction.

Google / YouTube privacy information

Spotify

Embedded audio players on some news pages.

Data involved: Browser IP address, request metadata and information about interaction with the player.
When used: On pages containing an embedded Spotify player; loading the iframe contacts Spotify before playback.

Spotify privacy information

Sveriges Riksbank

Exchange-rate data for currency calculations.

Data involved: Currency series identifiers, requested dates and service request metadata; exchange-rate requests do not need uploaded documents or account identities.
When used: When fetching exchange rates not already cached.

Sveriges Riksbank privacy information

GitHub

Source control, build workflows and issue reporting.

Data involved: Repository contents, build logs and information deliberately included in issues.
When used: For software development and issue reporting.

GitHub privacy information

Auth.js asset host

Google sign-in button icon.

Data involved: Server request metadata when the website image proxy fetches the public icon.
When used: When displaying the Google sign-in button.