Sub-processors
Last Updated: September 10, 2026 Version: 1.5
This page lists the third-party service providers that Incremenza LLC engages to help deliver the Incremenza platform. It is the authoritative list referenced by our Data Processing Addendum, our Privacy Policy, and our GDPR Compliance page.
We keep this page current. If you want to be notified when it changes, see the notification section at the end.
What a sub-processor is
When you use Incremenza, we process data on your behalf. To do that, we rely on a small number of specialist providers for things like hosting, email delivery, and error monitoring. Those providers are our sub-processors.
Every sub-processor listed here is bound by a written agreement that requires it to protect your data, to process it only on our instructions, and to meet standards at least as protective as those in our own agreement with you.
We do not sell your data, and we do not permit any sub-processor to use it for its own purposes.
How this list is organized
The providers below are grouped by when they come into play.
- Core sub-processors apply to every Incremenza account.
- Feature-specific sub-processors are engaged only if you use the feature that depends on them.
- Connections you initiate are services where you already hold the account and you authorize us to read data from it. In those cases you remain in control of the relationship.
1. Core sub-processors
These providers are involved in delivering the Service to all customers.
| Provider | What it does for us | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Content delivery network and DDoS protection for our website and application, including TLS termination at the network edge | Visitor IP addresses and web traffic metadata for all requests to incremenza.com | United States | Standard Contractual Clauses |
| DigitalOcean, LLC | Cloud infrastructure, application servers, and database storage | All Customer Data at rest | United States | Standard Contractual Clauses |
| Laravel (Laravel Forge and Laravel VPS) | Server provisioning and management, and Laravel VPS server hosting, which runs on DigitalOcean infrastructure | Server access, no direct access to Customer Data in normal operation | United States | Standard Contractual Clauses |
| SnapShooter | Encrypted database backups | All Customer Data, encrypted at rest | United States | Standard Contractual Clauses |
| Resend | Delivery of all outbound email, including account, billing, and customer-facing messages | Recipient name, email address, message content | United States | Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | Technical diagnostic data. Tokens, credentials, and payment data are automatically removed before transmission | United States | Standard Contractual Clauses |
| PostHog, Inc. (EU Cloud) | Product usage analytics within the logged-in application, used to understand which features are used and to improve the product | User identifier, account identifier, feature interaction events | European Union (Frankfurt, Germany) | Not applicable for EU data. Hosted within the EEA |
| Stripe, Inc. | Billing and payment processing for Incremenza subscriptions | Billing contact details, subscription and payment records. Full card numbers are held by Stripe and never by us | United States | Standard Contractual Clauses |
2. Feature-specific sub-processors
These providers are engaged only when you use the feature described.
| Provider | Feature | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Google LLC (Gemini) | Automated transaction classification and business guidance features. We use the paid enterprise tier, under which your data is not used to train Google's models | Merchant names, category names, and transaction amounts and dates for classification and anomaly detection; for the weekly digest, customer names paired with their revenue; for customer import, a customer's name, email, and phone. Never account numbers, card numbers, or credentials | United States | Standard Contractual Clauses |
| Anthropic, PBC (Claude) | Standby provider for the same guidance features, used when the primary provider is unavailable. Your data is not used to train Anthropic's models | Same as above | United States | Standard Contractual Clauses |
| Slack Technologies, LLC | Delivery of automated alert notifications to a Slack channel you configure, if you enable the Slack integration | The customer name, plan, health score, MRR, and owner name contained in the alerts you configure | United States | Standard Contractual Clauses |
| Plaid Inc. | Secure connection to your bank accounts for transaction and balance synchronization | Bank transaction history, balances, masked account identifiers | United States | Standard Contractual Clauses |
| Stripe, Inc. (Connect) | Embedded payments, where you accept payments from your own customers through a connected Stripe account | Your customers' payment and transaction records | United States | Standard Contractual Clauses |
| Google LLC (Sign-In) | Authentication, if you choose to sign in with a Google account | Name, email address, and a unique profile identifier | United States | Standard Contractual Clauses and the Google Workspace Data Processing Addendum |
| Microsoft Corporation (Sign-In) | Authentication, if you choose to sign in with a Microsoft account | Name, email address, and a unique profile identifier | United States | Standard Contractual Clauses and the Microsoft Products and Services Data Protection Addendum |
| Zapier, Inc. | Optional automated data exchange between Incremenza and other business tools you use | Whatever data you configure the connection to send or receive | United States | Standard Contractual Clauses |
3. Connections you initiate
The services below are ones where you hold the account and grant us permission to read from it. You remain the controller of that data and your relationship is governed by that provider's own terms.
We list them here for transparency, because data flows between them and Incremenza.
| Provider | What the connection does |
|---|---|
| Intuit (QuickBooks Online) | Reads your chart of accounts, invoices, bills, payments, customers, and vendors. Writes categorized transaction updates back only if you enable two-way sync |
| Square, Inc. | Reads point-of-sale and payment transaction records from your Square account |
| PayPal Holdings, Inc. | Reads transaction and subscription records from your PayPal account |
| Stripe, Inc. | Reads payment, customer, and subscription records from your own Stripe account |
| PostHog | If you connect your own PostHog instance, reads product usage signals about your customers so they can inform customer health scoring. This is your PostHog account and your data |
You can disconnect any of these at any time from your integration settings. When you disconnect, we revoke our access with the provider immediately.
4. Where your data is stored
Customer Data is stored on servers in the United States, operated by DigitalOcean.
Product usage analytics are stored in the European Union, in Frankfurt, Germany.
For transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, as described in our Data Processing Addendum.
If your organization requires EU-based storage of all data, contact us at [email protected] to discuss what is possible.
5. Notice of changes
Before we add a new sub-processor or replace an existing one, we will:
- Update this page with the new provider, its purpose, and its location
- Give at least 30 days' notice by email to account administrators before the new sub-processor begins processing personal data
If you object to a new sub-processor on reasonable data protection grounds, write to us at [email protected] within the 30-day notice period. We will work with you to find a resolution. If we cannot, you may terminate your subscription and receive a refund of prepaid fees for the unused portion of your term.
We may engage a replacement sub-processor without advance notice in an emergency, such as the sudden failure of a provider. Where that happens, we will notify you as soon as reasonably possible afterward.
To receive change notifications, email [email protected] and ask to be added to our sub-processor notification list. Account administrators are included automatically.
6. Providers we do not use
For clarity, because these questions come up in security reviews:
- We do not use Google Analytics, or any advertising, retargeting, session recording, or heatmap tool on our websites or in our application.
- We do not sell, rent, or share personal data with advertisers or data brokers.
- We do not use Customer Data to train any machine learning model, our own or anyone else's.
7. Contact
For questions about this list, to request a signed Data Processing Agreement, or to raise an objection to a sub-processor:
Incremenza LLC
2108 N ST STE N Sacramento, CA 95816 United States
We aim to respond to data protection inquiries within 5 business days.