Updated 2026-08-18 · Operator: AcctTen (acctten.com)
The following third-party service providers process personal data on our behalf as sub-processors. Each provider is engaged under a Data Processing Addendum that binds it, by contract, to a standard of protection comparable to the PDPA.
| Processor | Purpose | Region | Transfer basis | DPA |
|---|---|---|---|---|
| Supabase (Postgres, Auth, Storage) | Primary data store — tenants, employees, payroll records, audit logs, authentication | ap-southeast-1 (Singapore) | Stored in Singapore — no cross-border transfer. Supabase DPA | DPA ↗ |
| Vercel | Application compute, static hosting, edge functions | Global edge network | Vercel DPA with Standard Contractual Clauses | DPA ↗ |
| Stripe | Subscription billing + card payment processing (card data stays on Stripe — we never receive the card number) | United States | Stripe DPA with Standard Contractual Clauses | DPA ↗ |
| Google Vertex AI | Agentic payroll assistance — zero-retention inference, no model training on customer data | Global endpoint | Google Cloud Data Processing Addendum — no training on customer data, no retention of prompts | DPA ↗ |
| Sentry (Functional Software, Inc.) | Error telemetry only — a scrubbing hook removes NRIC, bank, salary and email fields before data leaves our servers | Configurable (default United States) | Sentry DPA with Standard Contractual Clauses | DPA ↗ |
| OneMap (Singapore Land Authority) | Postal code to address lookup at signup (no personal data in the query) | Singapore | Singapore government service — no cross-border transfer | DPA ↗ |
| ACRA Open Data | UEN to entity lookup at signup (Singapore Open Data Licence, attribution displayed) | Singapore | Singapore government open data — no cross-border transfer | DPA ↗ |
| Google OAuth | Optional social sign-in, for users who choose to sign in with Google | United States | Google Cloud Data Processing Addendum (same instrument as Vertex AI above) | DPA ↗ |
| Resend (Plus Five Five, Inc.) | Outbound email delivery — sign-in links, one-time codes, employee invitations, leave notifications, and accounting documents sent to a customer. Receives the recipient address and whatever the message itself names (for a leave notification, the employee name and leave type). For an accounting document it also receives the rendered PDF as an attachment, which carries the customer name and address, the supplier GST registration number, the line descriptions and the amounts | United States | Resend DPA with Standard Contractual Clauses | DPA ↗ |
Material changes: We will notify registered OWNER / ADMIN contacts at least 30 days in advance of any new sub-processor engagement that will materially alter the cross-border transfer pattern or the categories of personal data processed.
Questions or objections regarding sub-processors: dpo@acctten.com