Sub-Processors

In accordance with our Data Processing Agreement (DPA, available at https://norman.finance/de/en/dpa), Norman AI GmbH uses the following sub-processors to provide our services. We will update this page when sub-processors are added or replaced and notify affected customers in accordance with Section 6 of our DPA.

If you have questions, contact us at compliance@norman.finance.

Infrastructure & Hosting

DigitalOcean, LLC
101 Avenue of the Americas, New York, NY 10013, USA
Purpose: Cloud infrastructure & hosting
Data processed: All platform data including user accounts, financial data, and documents
Location: EU data center (Frankfurt, Germany)
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Amazon Web Services EMEA SARL
38 Avenue John F. Kennedy, L-1855 Luxembourg
Purpose: Cloud infrastructure & storage
Data processed: Platform data, backups, file storage
Location: EU data center (Frankfurt, Germany)
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Cloudflare, Inc.
101 Townsend St., San Francisco, CA 94107, USA
Purpose: Network security, DDoS protection and delivery of the app and API
Data processed: All data sent to and from the app and API, IP addresses
Location: Global network (worldwide)
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Bank Connections

finAPI GmbH
Adams-Lehmann-Straße 44, 80797 München, Germany
Purpose: Connection of bank accounts and retrieval of account data and transactions
Data processed: Bank access data entered by the user, account details, balances, transactions
Location: Germany
Transfer mechanism: N/A (EU-based entity)

AI Processing

OpenAI OpCo, LLC
3180 18th Street, San Francisco, CA 94110, USA
Purpose: AI-assisted tax & accounting analysis
Data processed: User queries, financial data as submitted by the user through the AI chat
Location: USA
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Anthropic, PBC
548 Market St, PMB 90375, San Francisco, CA 94104, USA
Purpose: AI-assisted tax & accounting analysis
Data processed: User queries, financial data as submitted by the user through the AI chat
Location: USA
Transfer mechanism: Standard Contractual Clauses

Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Purpose: AI-assisted tax & accounting analysis and document processing (Azure OpenAI Service)
Data processed: User queries, financial data and uploaded documents (e.g. receipts, invoices, payslips, contracts)
Location: EU
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Communication

Twilio Inc. (SendGrid)
101 Spear Street, Suite 500, San Francisco, CA 94105, USA
Purpose: Transactional email delivery
Data processed: Name, email address
Location: USA
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Plus Five Five, Inc. (Resend)
2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Delivery of transactional emails, newsletters and email series
Data processed: Name, email address, language, legal form
Location: EU sending region (Ireland)
Transfer mechanism: Standard Contractual Clauses

Intercom, Inc.
55 2nd Street, San Francisco, CA 94105, USA
Purpose: Customer support chat and in-app messages
Data processed: Name, email address, chat messages, usage data
Location: USA
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Analytics & Monitoring

Functional Software, Inc. d/b/a Sentry
45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Purpose: Error monitoring & application performance
Data processed: Technical error logs, anonymized usage data, IP addresses
Location: EU data center available
Transfer mechanism: EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Third-Party Data Recipients (not sub-processors)

The following entities receive personal data in the course of our services but are not sub-processors in the GDPR sense, as they act as independent data controllers:

ELSTER / German Tax Authorities (Finanzamt)
Purpose: Submission of tax returns and VAT filings
Data transmitted: Tax return data, personal identification data, tax IDs