Subprocessors
Last updated September 30, 2026Effective September 30, 2026
Circo, Inc. uses the companies below to provide Accountable. Each one processes customer data only to provide its service to us, under written data protection terms at least as protective as our Data Processing Addendum. This page is Annex C of the Data Processing Addendum.
Used for every customer
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and compute, databases, file storage, each company's ledger store, DNS, inbound email and network security | All customer data | United States; requests are served from Cloudflare's global network |
| Vercel Inc. | AI Gateway that routes AI requests to the model provider | The parts of the books and requests an AI feature needs | United States |
| OpenAI, L.L.C. | AI model provider for the AI accountant, categorization, document reading, the close and the support agent | The parts of the books and requests an AI feature needs; not used to train models | United States |
| Stripe, Inc. | Subscription billing, checkout and Service Desk payments | Billing contact, payment method, invoices | United States |
| Resend (Plus Five Five, Inc.) | Delivery of sign-in codes, invitations, approvals, reports and other emails | Recipient email addresses and email contents | United States |
| DataFast (Marc Lou, sole proprietor) | Website analytics: visit counts and campaign attribution on https://accountable.im and in the app | Page addresses, referrer, campaign tags, browser and device type, approximate location, a random visitor identifier and, for signed-in users, name, email address and profile photo; never the contents of the books | See DataFast's data processing agreement |
Used only when you turn on an integration
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. (Financial Connections) | Read-only connections to banks and cards, the default way to link one | Account names, masked numbers, balances and transactions | United States |
| Plaid Inc. | Read-only connections to banks and cards | Account names, masked numbers, balances and transactions | United States |
| Teller | Read-only connections to banks and cards | Account names, masked numbers, balances and transactions | United States |
| Google LLC | Sign in with Google; reading Gmail and Google Drive for receipts and statements when you connect them | Name, email address and profile picture; the messages and files the close matches | United States |
| Slack Technologies, LLC | Approvals, month-end posts and questions in your Slack workspace | Channel identifiers, message contents | United States |
| Intuit Inc. | Moving books from QuickBooks Online and keeping a QuickBooks mirror | Your books in QuickBooks | United States |
| Xero Limited | Moving books from Xero | Your books in Xero | United States (hosting); Xero Limited is based in New Zealand |
Services you connect are yours, not our subprocessors
When you connect your own accounts, such as Mercury, Brex, Ramp, your own Stripe account, Gusto, Rippling or Deel, the accounting tool you are moving from, or an AI assistant such as Claude, ChatGPT or Cursor through our MCP server or API, you are instructing us to exchange data with a service you chose. Those services process your data under your own agreements with them. Payments to invoices you send with a payment link are processed by your own payment processor account; Accountable never receives or holds those funds.
How we tell you about changes
At least thirty (30) days before a new subprocessor starts processing customer data, we publish a new version of this page with the change and its date, and email every workspace owner. Every earlier version of this page stays readable from the version history below, so you can see what changed and when. Anyone else can get the notices by writing to privacy@accountable.im. If you object to a new subprocessor on reasonable data protection grounds, tell us at privacy@accountable.im within thirty (30) days, as described in Section 6 of the Data Processing Addendum.
Version history
- September 30, 2026Effective September 30, 2026Added Stripe Financial Connections for read-only bank and card links.
- September 29, 2026Effective September 29, 2026Added DataFast (website analytics).
- September 28, 2026Effective September 28, 2026First published version.
Questions about this document: legal@accountable.im.