Sub-processors
Last updated: 11 October 2026
These service providers process your company’s data for Heft, each under a contract according to Art. 28 GDPR. The list is part of the data processing agreement (AVV). How Heft processes data is set out in the privacy policy.
1. The list
Google Cloud
- Company
- Google Cloud EMEA Limited, Dublin, Ireland
- What for
- Servers, database, files, backups, keys and technical logs; the browser that fetches invoices from supplier portals; AI models (Vertex AI) that read receipts and do Heft's work.
- Where
- Frankfurt am Main (europe-west3) and the EU
- Outside the EU
- Processed in the EU. For possible access by the parent company Google LLC (USA): EU-US Data Privacy Framework and EU standard contractual clauses.
Amazon Web Services
- Company
- Amazon Web Services EMEA SARL, Luxembourg
- What for
- AI models (Amazon Bedrock).
- Where
- Frankfurt am Main (eu-central-1)
- Outside the EU
- Processed in the EU. For possible access by the parent company Amazon.com, Inc. (USA): EU-US Data Privacy Framework and EU standard contractual clauses.
Resend
- Company
- Plus Five Five, Inc. (Resend), San Francisco, USA
- What for
- Heft's emails, such as sign-in codes, invites and notices, and receiving the receipts forwarded to your Heft address.
- Where
- Resend's EU region
- Outside the EU
- Processed in the EU. For possible access from the USA: EU standard contractual clauses.
Enable Banking
- Company
- Enable Banking Oy, Espoo, Finland
- What for
- The connection to your bank, read-only.
- Where
- EU
- When
- Only if you connect a bank account.
- Outside the EU
- No transfer outside the EU.
2. When the list changes
Before a provider is added or replaced, we email the directors of every company and change the date at the top. Your company can object to the change as the AVV sets out.