Subprocessors
Last updated 27 August 2026
THOSORO uses a small number of vendors to operate the platform. Each one is bound by a written data processing agreement, processes data only on our instructions, and is listed below with its purpose and hosting location. We notify workspace administrators before adding or replacing a subprocessor.
1. Current subprocessors
| Vendor | Purpose | Location | Data processed |
|---|---|---|---|
| Supabase / AWS | Managed PostgreSQL database, authentication and encrypted object storage | European Union (eu-central) | All workspace business records, account identities, generated documents |
| Cloudflare | Application hosting, TLS termination and edge delivery | European Union / global edge | Request metadata, IP addresses |
| Resend | Transactional e-mail delivery (invitations, documents, notifications) | European Union | Recipient name, e-mail address, message content |
| Mollie | Card and terminal payment processing for the point-of-sale module | Netherlands | Payment amounts, transaction references |
2. International transfers
Primary processing takes place inside the European Economic Area. Where a vendor may process data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses together with a transfer impact assessment and, where applicable, supplementary technical measures such as encryption in transit and at rest.
3. Changes and objections
We announce a new or replacement subprocessor to workspace administrators at least 30 days before it begins processing. If you have a reasonable objection on data protection grounds, write to legal@thosoro.com within that period and we will discuss an alternative or, failing that, you may terminate the affected service.