This page lists the third-party providers (“subprocessors”) that Dori Finance uses to deliver the Platform and the Website, and that may process personal data on our behalf. It forms part of our Privacy Policy and Terms and Conditions.
Every subprocessor is bound by a written contract that meets Article 28 of the GDPR, including confidentiality and security obligations. Where a provider is established outside the European Economic Area, the table shows the transfer mechanism we rely on.
Platform (app.dorifinance.com)
These providers process Customer Data, which may include financial records and personal data about your customers, suppliers and employees.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Xano, Inc. | Application backend and managed database | Account data, financial data, bank connection data | Paris, France (EU) | Not applicable, data stays in the EU |
| Google Cloud EMEA Ltd. (Google Cloud Storage) | Storage of uploaded documents and files | Invoices, receipts, statements and other uploaded files | European Union, multi-region | Not applicable, data stays in the EU |
| Google Cloud EMEA Ltd. (Vertex AI) | AI document extraction, categorisation and reconciliation suggestions | Document content and transaction data | European Union | Not applicable, data stays in the EU. Customer data is not used to train Google’s models |
| Mistral AI SAS | AI document extraction, categorisation and reconciliation suggestions | Document content and transaction data | Paris, France (EU) | Not applicable, data stays in the EU. Customer data is not used to train Mistral’s models |
| GoCardless Ltd. (Bank Account Data) | Open banking connections to customers’ bank accounts | Account holder name, IBAN, balances, transaction history | United Kingdom | UK adequacy decision |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | Company billing details, payment method (card data is held by Stripe only) | Dublin, Ireland (EU) | Not applicable, data stays in the EU |
| Twilio Inc. (SendGrid) | Transactional email (account verification, invitations, alerts) | Name, email address, email content | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring and application diagnostics | Technical data, user identifier, IP address, error context | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| PostHog, Inc. | Product analytics inside the Platform, with your consent | Usage events, device and browser data, user identifier | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Ltd. (Google Workspace) | Internal email, support correspondence and document handling | Communications with you | European Union | Not applicable, data stays in the EU |
Website (dorifinance.com)
These providers are used only on the marketing website and process data about visitors, not Customer Data from the Platform.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Website hosting and content delivery | IP address, browser and request data | United States, with global edge network | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Formspree, Inc. | Contact form and Financial Health Assessment submissions | Name, email address, company, form answers | United States | Standard Contractual Clauses |
| Kit (ConvertKit LLC) | Newsletter subscriptions | Email address, consent record | United States | Standard Contractual Clauses |
| Loops, Inc. | Waitlist and newsletter subscriptions | Email address | United States | Standard Contractual Clauses |
| Cal.com, Inc. | Demo and call booking | Name, email address, booking details | United States | Standard Contractual Clauses |
| Cloudinary Ltd. | Image hosting and delivery | IP address (technical) | United States and European Union | Standard Contractual Clauses |
| Google Ireland Ltd. (Google Analytics 4) | Website analytics; cookies and identifiers only with your consent | IP address (technical), pseudonymous usage events, pages visited, approximate location, device and browser data | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google LLC (Google Fonts) | Web font delivery | IP address (technical) | United States | EU-US Data Privacy Framework |
| Google LLC (YouTube, privacy-enhanced mode) | Embedded videos, loaded only when you press play | IP address, playback data | United States | EU-US Data Privacy Framework |
Changes to this list
We will update this page at least 14 days before a new subprocessor starts processing Customer Data, except where an urgent replacement is needed to maintain security or availability, in which case we will update it as soon as possible. Customers who want to be notified by email of changes can ask at hello@dorifinance.com. If you object to a new subprocessor on reasonable data protection grounds and we cannot offer an alternative, you may terminate the affected service under Section 10 of the Terms.
Contact
Questions about any provider on this list: hello@dorifinance.com.