Subprocessors
Last updated: 2026-10-23
This page lists every third party ("Subprocessor") that Latent Software LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, engages to process Customer Personal Data in InvoiceCow: the personal data of a merchant's buyers and of other people in its sales and invoices, as the Data Processing Addendum defines it. At least 15 business days before a new or replacement Subprocessor begins to process Customer Personal Data, we tell each merchant by email and update this page, and the merchant may object (DPA Section 6).
1. Subprocessors of Customer Personal Data
| Subprocessor | Legal entity | Purpose | Data | Location |
|---|---|---|---|---|
| Hetzner | Hetzner Online GmbH (Germany), with its subsidiary Hetzner US LLC | The servers that run the Service and its database | All data in the Service | Ashburn, Virginia, USA |
| Amazon Web Services | Amazon Web Services, Inc. (USA) | Email delivery (Amazon SES); file storage and the encrypted database backups (Amazon S3) | Emails that the Service sends (such as Portal links and invoices sent by a merchant); stored files and documents; a copy of the database | us-east-1 (N. Virginia), USA |
| Cloudflare | Cloudflare, Inc. (USA) | DNS, network proxy, TLS and protection against attacks and bots for our domains | All web traffic to the Service passes through it | USA and its global edge network |
We bind each Subprocessor by a written agreement with the data protection obligations that DPA Section 6.5 requires, including the EU Standard Contractual Clauses (2021/914) where a transfer requires them.
2. Other service providers
These providers process data for which we are the controller, under the Privacy Policy. They do not process Customer Personal Data.
| Provider | Legal entity | Purpose | Data | Location |
|---|---|---|---|---|
| Stripe | Stripe, Inc. (USA) and its affiliates | Payments and billing of the optional Footer Subscription | The subscriber's name, email address, billing details and payment details | USA and other countries where Stripe operates |
3. What is not on this list, and why
- Your own payment processors and platforms (such as Stripe, Shopify, Paddle or Lemon Squeezy, when you connect them): they are your vendors, under your own agreements with them. We read your sales from them on your instruction; they do not process data on our behalf.
- AccountingYear: a product of Latent Software LLC itself, not a third party. Data reaches it only if you turn on the sync, and the AccountingYear terms, privacy policy and subprocessor list then govern it.
- VIES: the European Commission's VAT number check. It is a public service that answers our queries about a VAT number, not a provider that processes data for us.
- Umami analytics: software that we host ourselves. No analytics company receives data, and the events contain no buyer personal data.
- Geolocation: we derive an approximate location from an IP address from the location data that Cloudflare already attaches to each request, or from a database on our own servers. We do not send IP addresses to any geolocation service.