Subprocessors.
The material subprocessors we engage to operate the platform: what each one does, where it processes data and the categories of data involved. Referenced from clause 6 of our Privacy Policy and clause 4 of our Terms. This list is updated when a material change occurs; last updated 2026-10-11.
Where data is stored and processed
Our platform runs on AWS. Your firm's own database and uploaded files are held on AWS in the region for the country you chose at sign-up: Australia (Sydney), New Zealand (Auckland), the United Kingdom (London), the United States (Northern Virginia) or Canada (Montreal). Firms outside Australia that signed up before their country's region opened in October 2026 are in Sydney and stay there unless they ask to move. For every firm, the platform itself runs in Australia and reads your database from there, and your account records, logins, billing and usage records, EVA's conversation history and working notes, the analyses, reports, pulses and plans EVA writes for you, your saved report and dashboard definitions, in-app messages and operational logs are held in Sydney. We will update this page before any customer data is hosted in a region not listed here. EVA runs on Amazon Bedrock under our AWS agreement. The model that orchestrates each request is supplied by Anthropic and runs in the AWS geography of your firm's region: Australia for firms hosted in Australia or New Zealand, Europe for firms hosted in the United Kingdom, the United States for firms hosted in the United States, and North America for firms hosted in Canada. The model that does the heavy lifting is supplied by OpenAI and runs in that same geography for firms hosted in the United States or Canada, and for every other firm on AWS infrastructure which may be outside your country. Neither model developer receives your data through Amazon Bedrock, and no model is trained on it. We also use the Anthropic API directly for web search, for document exports and as a backup, and that processing takes place in the United States.
We change the specific model versions we use from time to time and record them internally; we update this page when a provider, a country of processing or a category of data changes. Copies of our own platform records are also kept in the Asia Pacific (Melbourne) region in Australia for backup purposes. The AI model provider rows below are the second sentence, itemised, and those providers do not train on your data. The same two sentences open our security page.
Material subprocessors
These process client data on our behalf as part of operating the VibeCFO platform.
| SUBPROCESSOR | SERVICE | PROCESSING LOCATION | CATEGORIES OF DATA |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, and AI model inference through Amazon Bedrock | Your firm's own database and uploaded files: the AWS region for your country (Sydney, Auckland, London, Northern Virginia or Montreal), or Asia Pacific (Sydney) for a firm that signed up before its country's region opened. The platform and its records about your firm: Asia Pacific (Sydney), with backup copies of our platform records in Asia Pacific (Melbourne). AI inference: the orchestration model in Australia for firms hosted in Australia or New Zealand, Europe for firms hosted in the United Kingdom, the United States for firms hosted in the United States, and North America for firms hosted in Canada; the worker model in that same geography for firms hosted in the United States or Canada, and on AWS global infrastructure for every other firm | All platform data: client financial and accounting data, client documents and EVA knowledge content, account and audit records; and, as inference input, questions, schema context, query result rows and uploaded images |
| Microsoft Corporation | Azure Power BI Embedded (client firm reporting) and Microsoft Entra ID (identity services for client reporting users) | Azure Australia East and Australia Southeast (Power BI Embedded); global (Entra ID) | Client financial reporting datasets; external user identities and authentication data for client-side accounts |
| Anthropic PBC | Backup model inference, web search and fetch, and the document export lane | United States or global | As inference input: questions, schema context and result rows, and the complete result set for exports |
| Stripe, Inc. | Subscription billing and payment processing for our customers' subscriptions | As stated in Stripe's own privacy policy | Customer firm billing contact name and email; subscription and invoice records |
| Ezidebit (Global Payments) | Direct debit collection for our customers' subscriptions | As stated in Ezidebit's own privacy policy | Customer firm bank account or direct debit authority details |
| Brevo (Sendinblue SAS) | Customer relationship management and email | European Union (France, Germany and Belgium) | The names, email addresses and firm of our customers' contacts; and, where a business has connected email sending to EVA, the recipients and content of an email that EVA sends on a user's confirmation |
Stripe and Ezidebit handle billing and payment collection for our customers' subscriptions, in respect of billing contact and payment details only. No cardholder data is stored, processed or transmitted by VibeCFO.
Website and marketing providers
These are not subprocessors of client data. They handle the details of people who register for a webinar, send us an enquiry or book a call through this website.
| PROVIDER | SERVICE | PROCESSING LOCATION | CATEGORIES OF DATA |
|---|---|---|---|
| Zoom | Webinar hosting and registration | United States | Names and email addresses of webinar registrants |
| Resend | Delivery of website contact-form enquiries to our team | United States | Names, email addresses and messages of people who contact us |
| Calendly | Meeting scheduling | United States | Names, email addresses and booking details of people who book a call |
We provide reasonable advance notice of material changes to this list, per the Terms. Questions - or a vendor assessment to complete - go to admin@vibecfo.ai. See also the security page and privacy policy.