Legal · Español
Sub-processors
Last updated: July 2026
Fyxi relies on a small group of external providers (sub-processors) to operate the Service. This page is the official source of that list. We update it when we add, change, or remove a provider. Business plan customers can request email notifications when the list changes by writing to privacy@fyxi.ai.
| Provider | Purpose | Location | Certifications | Policy |
|---|---|---|---|---|
| Vercel Inc. | Web frontend hosting (Next.js). Serves the application UI and public pages. | United States (with globally cached edge) | SOC 2 Type II | View policy |
| Convex Inc. | Backend, database, and serverless functions. Stores workspace data, tickets, budgets, workflows. | United States | SOC 2 Type II | View policy |
| Cloudflare, Inc. (R2) | Storage of original receipt images and PDFs, with access via short-lived signed URLs. | United States (buckets in auto configuration) | SOC 2 Type II, ISO 27001 | View policy |
| Google LLC (Gemini API) | Receipt data extraction via artificial intelligence. Fyxi uses the paid commercial tier, where Google does not use content to train models. | United States | SOC 2 Type II, ISO 27001, ISO 27701 | View policy |
| Stripe, Inc. | Subscription payment processing. Fyxi does not see or store full card numbers. | United States (with global presence) | PCI-DSS Level 1, SOC 1 Type II, SOC 2 Type II | View policy |
| Resend Inc. | Transactional email sending (verification, notifications, digest). | United States | SOC 2 Type II | View policy |
| Twilio Inc. | WhatsApp message sending and receiving for receipt upload via that channel (integration via WhatsApp Business API). | United States | SOC 2 Type II, ISO 27001 | View policy |
| Better Auth | User authentication (email + password, Google OAuth). Secure session management. | Runs embedded in Convex (United States) | — | View policy |
| Google LLC (OAuth) | Provides the "Sign in with Google" mechanism. Only if you choose that option. | United States (global) | — | View policy |
Changes and notifications
When we add a new sub-processor that processes personal data, we update this page before the new provider goes into production. For Business plan customers with a signed DPA, we also send an email notification at least 15 days in advance when the change is material.
Data Processing Agreement (DPA)
Business plan customers (or future equivalents) may request the signing of a Data Processing Agreement (DPA) where Fyxi acts as “processor” and the customer as “controller”. Send your request to privacy@fyxi.ai with the legal name of your company and we will send you the draft.
Legal review status. This page is the current state of the providers we use. The description of purposes and certifications is based on public information from each provider at the time of publication. Links to external policies point to each provider's official site.