Subprocessors

The stack is intentionally narrow. AlpInvoice only adds vendors that are needed to host the app, process payments, or deliver operational email.

• Hosting and infrastructure providers run the application, database, and encrypted storage layers.
• Stripe handles hosted checkout, subscription billing events, and payment-related customer mapping.
• MailerSend handles transactional email such as account or payment-profile communication when enabled.

Each vendor should receive the smallest practical dataset for its role, under documented contracts and operational checks.

• Only the data needed for the specific service path should be shared with each vendor.
• DPA status, transfer posture, and key operational notes should be reviewed and versioned.
• Internal access should stay limited and auditable when vendor-linked data is reviewed.

Swiss and EU hosting remains the preferred baseline, while some vendors may still involve international transfer mechanisms that need legal review.

• Core hosting and storage should stay in Switzerland or the EU whenever practical.
• US-linked vendors require contractual and transfer-review follow-up before enterprise claims are made.
• This register should be updated whenever a vendor, region, or purpose changes.