Last updated: 2026-10-10
Version: 1.2
Plirin uses the following sub-processors to operate our services. This list is maintained in accordance with our obligations under GDPR Article 28 and our Data Sharing Policy.
Current Sub-Processors
| Vendor | Purpose | Data Shared | Location | GDPR / DPA Status | Contact / Website |
|---|---|---|---|---|---|
| Didit | KYB (business verification), AML screening (sanctions / PEP / adverse media), Crypto wallet screening, UBO liveness/KYC (tier upgrade) | Business name, registration details, UBO names + DOB + address, wallet addresses, identity documents (on Didit's platform), UBO selfie/video (for tier upgrade only) | EU (AWS) | GDPR-compliant; SOC 2 Type 2; ISO 27001 / 27017 / 27018; DPA to be executed before production cutover | hello@didit.me / https://didit.me |
| Amazon Web Services (S3) | Long-term encrypted document archival (FinCEN regulatory recordkeeping) | KYB verification documents (encrypted at rest via KMS) | US East-1 (N. Virginia, USA) | GDPR-compliant via SCCs (Standard Contractual Clauses) | https://aws.amazon.com/privacy/ |
| Amazon Web Services (KMS) | Encryption key management for document storage | No personal data transmitted; manages encryption keys only | US East-1 (N. Virginia, USA) | GDPR-compliant via SCCs | https://aws.amazon.com/kms/ |
| Resend | Transactional email delivery (account notifications, KYB status, compliance alerts, UBO verification links) | Recipient email address, email subject and body content | United States | SOC 2 compliant; DPA available | https://resend.com |
| Amazon Web Services (S3), invoice attachments | Storage of files merchants attach to invoices and estimates | The files merchants upload (for example purchase orders, contracts, delivery notes) | eu-central-1 (Frankfurt, Germany) | GDPR-compliant; DPA included in the AWS service terms | https://aws.amazon.com/privacy/ |
| OpenAI | AI features: the dashboard assistant, and, when enabled, drafting invoices from uploaded documents and importing invoices from PDF | Merchant prompts, and the documents a merchant uploads for drafting or importing (which can include their customers' names, emails and amounts) | United States | DPA available; no training on API data; abuse-monitoring retention per OpenAI's API data policy | https://openai.com/policies/ |
| Backblaze B2 | Encrypted database backups | Full database backup | United States or EU, depending on the bucket | DPA available | https://www.backblaze.com/company/privacy.html |
| Stripe | Card payment processing, only for merchants who connect their own Stripe account. Plirin never opens a Stripe account for a merchant and never holds the money. | With each card payment Plirin sends Stripe the amount and currency, a description ("Invoice N"), and metadata holding the Plirin invoice ID, invoice number and merchant ID. With each card refund it sends the amount and metadata holding the Plirin refund reference, invoice ID and merchant ID. No customer record is created. The payer's card or wallet details are entered into Stripe's payment form and are handled by Stripe, never by Plirin. Stripe may hold the payer's email address if the payer enters it or the merchant's Stripe settings send receipts. Payment, refund and dispute status is returned to Plirin by Stripe; payer details in those notifications are discarded on arrival | United States and other regions where Stripe operates | Stripe Data Processing Agreement, which covers international transfers (https://stripe.com/legal/dpa) | https://stripe.com/privacy |
Notes
-
Didit DPA: Didit acts as a data processor; Plirin remains the data controller. A Data Processing Agreement will be executed before production cutover, which is pending sandbox validation.
-
AWS SCCs: Amazon Web Services participates in the EU-US Data Privacy Framework and provides Standard Contractual Clauses for data transfers from the EU/UK to US-based AWS regions.
-
Resend: Used for transactional email only. No marketing email is sent via Resend. Email logs are retained for 30 days per Resend's standard policy.
-
iDenfy (dormant): A prior KYB vendor (iDenfy) was evaluated but not activated in production. No merchant data was transmitted to iDenfy. The integration code is dormant in the codebase.
-
AWS S3 (invoice attachments): A separate bucket from the KYB archive above, in eu-central-1 (Frankfurt). It holds only files that merchants attach to their own invoices and estimates, and files are downloaded through time-limited links.
-
OpenAI: Used for the dashboard assistant. Drafting invoices from uploaded documents and importing invoices from PDF use the same service but are not yet enabled for merchants. Under OpenAI's API terms, data sent through the API is not used to train its models, and is retained for abuse monitoring for the period set out in OpenAI's API data policy.
-
Backblaze B2: Holds encrypted copies of our database backups for disaster recovery. Backups contain the same data as the production database, and are encrypted before they are uploaded.
-
Stripe: Used only when a merchant connects their own Stripe account to take card payments on invoices. Card payments are created directly on the merchant's own Stripe account, so Stripe's own terms and privacy policy apply to that payment between Stripe and the merchant. Plirin does not receive or store card numbers, and does not store the merchant's Stripe keys. Plirin's own payment receipt emails are sent through our email provider (Resend), not Stripe; Stripe may also send its own receipts, depending on the merchant's Stripe settings. Stripe's notifications about payments, refunds and disputes are reduced on arrival to the identifiers Plirin needs, and the payer's name, contact details and card details in them are discarded.
Changes to this list
We will notify affected customers at least 14 days before adding or replacing a sub-processor, as required by GDPR. Updates will be reflected on this page with a new "Last updated" date.
If you have concerns about a specific sub-processor, contact privacy@plirin.com.