Sub-processors
Last updated: 22 August 2026
CFO Pal uses a small number of third party providers to deliver the Service. This page lists every provider that may process personal data on our customers' behalf.
We give at least 30 days' notice before adding or replacing a sub-processor. To be notified of changes, email privacy@cfopal.co.uk.
Your financial data is not used to train AI models
We do not use customer data to train, fine-tune or develop artificial intelligence models, and our agreement with our AI provider prohibits them from doing so.
Our AI also does not calculate any figure. Every number in CFO Pal is computed by our own engine from your accounting data; the AI is given completed figures and asked to explain them. Full detail at cfopal.co.uk/ai.
Where your financial data lives
Your accounting data is stored in the United Kingdom and processed in the United Kingdom. The providers below that sit outside the UK handle email addresses, phone numbers, message content and billing details rather than your ledger.
Current sub-processors
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication and file storage | London, United Kingdom | None required — UK |
| Vercel | Application hosting and compute | London, United Kingdom | None required for compute — UK. Static assets are served through a global content delivery network. |
| Anthropic | AI-generated commentary and insights | United States | UK International Data Transfer Addendum to the EU Standard Contractual Clauses |
| Stripe | Payment processing and subscription billing | Ireland and United States | UK adequacy regulations (Ireland); UK Addendum to the EU Standard Contractual Clauses (United States) |
| Resend | Transactional email and alerts | Sending from Ireland; account data and delivery logs in the United States | UK Addendum to the EU Standard Contractual Clauses |
| Twilio | SMS and WhatsApp alert delivery | United States | UK Addendum to the EU Standard Contractual Clauses |
| Microsoft 365 | Business mailbox and support correspondence | United Kingdom | None required — UK |
Accounting integrations
The following are not sub-processors. You hold the relationship with these platforms directly and authorise CFO Pal to read your data from them. We do not send your data to them.
| Platform | What we access |
|---|---|
| Xero | Ledger, invoices, contacts and financial reports, read-only, with your authorisation |
| QuickBooks | Ledger, invoices, contacts and financial reports, read-only, with your authorisation |
| Sage | Ledger, invoices, contacts and financial reports, read-only, with your authorisation |
You can revoke CFO Pal's access from within your accounting platform at any time.
Suppliers that do not process customer data
We also use tools for source control, project management and internal communication. These are not listed because customer data does not reach them.