Subprocessor List

This page lists the third-party Subprocessors that Taxably, Inc. uses to support delivery of its Services. Each Subprocessor other than Google Analytics is contractually bound by data-protection obligations no less protective than those in our Data Processing Addendum. Google Analytics is used under Google's standard terms, as the paragraph below and its row in the table say.

Where processing happens. Every Subprocessor in the table below Processes data inside the United States, with three qualifications. The first is Google Analytics, which measures visits to Taxably's websites only after a visitor accepts analytics cookies and receives no taxpayer data; it is used under Google's standard terms, which do not commit Analytics processing to a location. The second is Google Workspace, which hosts Taxably's support and correspondence email; no data region is recorded as set for it, so Google does not commit that processing to a location, and Taxably does not accept client tax documents by email. The third is document reading. Taxably Connect sends document content to be read only to Google's United States endpoints (the United States multi-region endpoint (us), or a single United States region where that endpoint does not serve) and refuses Google's global endpoint, which serves a request from wherever there is capacity anywhere in the world and does not guarantee that it is processed in the United States. Google does not report where an individual request is processed.

Important: how taxpayer document data is handled. The current installer defaults to reading documents individually. On that path, source documents remain on the Firm's computer and their pages travel over encrypted connections directly to Google Cloud Vertex AI. Taxably's hosted account service is not on that path and holds no copy of a document. The hosted structured records reference taxpayers through opaque tokens rather than names, with identifying numbers removed before storage. Google Cloud Run hosts an account service that a linked computer contacts before its documents are read; it receives device and request information, and no document or client content.

Bulk processing is off by default. Where separately enabled, document pages are temporarily held in United States storage administered by Taxably and provided by Google Cloud Storage, with administrative access and deletion obligations as described in Section 3.2 of the Data Processing Addendum. That conditional processing is distinct from the individual-document path; the statement that Taxably holds no copy applies to the latter.

Connected AI assistants. A Firm may connect an AI assistant to the Taxably Connect application on its own computer. The assistant's questions and the answers the Firm's computer returns do not pass through Taxably's servers or any Taxably Subprocessor, and an answer can contain client information from the Firm's records. Taxably no longer offers a connection through the Firm's Taxably account or from outside the Firm's computer. The assistant's own provider is chosen by the Firm and is not a Taxably Subprocessor.

Provider retention and model training are separate. Taxably does not authorize training or fine-tuning on customer tax content. Google's published training restriction does not establish zero retention for Taxably's project. Applicable provider terms, approved exceptions, settings and features determine retention. Google's abuse-monitoring guidance describes conditional prompt logging for up to 90 days unless an applicable agreement or approved exception excludes it. On September 28, 2026, Google notified Taxably that it approved an exception to abuse-monitoring prompt logging for Taxably's Google Cloud project. Taxably has retained the approval as evidence. The effective time, covered models, production request coverage and other storage settings are still being verified. This project-specific approval does not establish blanket zero retention or extend to other projects or providers. See the AI & Model Training Policy. This disclosure does not waive or reduce Taxably's obligations under the Data Processing Addendum.

Current Subprocessors

Notification of New Subprocessors

Taxably gives at least 30 days' advance notice of the engagement of a new or replacement Subprocessor that will Process Personal Data, as described in Section 8 of the Data Processing Addendum.

Customers may subscribe to email notifications of Subprocessor changes by emailing legal@taxably.ai with the subject line "Subscribe: Subprocessor updates".

Customers who object to a new Subprocessor on reasonable data-protection grounds may exercise their objection rights as described in Section 8.5 of the Data Processing Addendum.

Change history

• 2026-10-30: Taxably retired the connection of an AI assistant through a Firm's Taxably account and from outside the Firm's computer. A connected assistant now asks Taxably Connect on the Firm's own computer, so its questions and answers no longer pass through Amazon Web Services, and that data was removed from the Amazon Web Services row. Data Processing Addendum obligations remain unchanged.
• 2026-10-27: Described the Google Cloud Run service in general terms: an account service a linked computer contacts before its documents are read, which receives device and request information and no document or client content. No Subprocessor added or removed, and no change to what any of them receives or where it processes.
• 2026-10-22: Named Google LLC (Google Workspace), which hosts Taxably's support and correspondence email, including support@taxably.ai. It was already in use before this entry; no data region is recorded as set for it, so its processing location is not committed, and Taxably does not accept client tax documents by email. Section 8.4 of the Data Processing Addendum describes the notice for a new Subprocessor. No change to which Subprocessor reads a document.
• 2026-10-20: "Where processing happens" and the Google Cloud Vertex AI row now describe document reading as every linked computer does it: Taxably Connect sends document content to be read only to Google's United States endpoints and refuses the global endpoint. The routing of earlier versions is recorded in the 2026-10-13 entry below. No Subprocessor added or removed.
• 2026-10-13: Corrected "Where processing happens" and the Google Cloud Vertex AI row, and with them the 2026-08-21 entry below, which said document reading was pinned to the United States multi-region. Taxably Connect versions 3.0.0 to 3.3.6 sent reading requests to Google's global endpoint, which does not guarantee that a request is processed in the United States, and Google does not report where an individual request was processed. From version 3.3.7, reading requests go only to Google's United States endpoints; a computer still on an earlier version keeps the earlier routing until it updates. The 2026-08-21 entry is kept as it was. No Subprocessor added or removed.
• 2026-09-28: Recorded Google's project-specific abuse-monitoring prompt-logging approval. Effective time, model scope, production coverage and other storage controls remain under verification; no blanket zero-retention claim was added.
• 2026-09-25: The opening sentence no longer says Google Analytics is bound by terms matching the Data Processing Addendum. It is used under Google's standard terms, as its row already said. No Subprocessor added or removed, and no change to what any of them does.
• 2026-09-25: Corrected the 2026-09-10 entry. The credential service hosted on Google Cloud Run did not previously run on Amazon Web Services; it was first deployed on Google Cloud Run on 2026-09-10. Named the paired computer's IP address and request metadata among what that service receives.
• 2026-09-25: Named Google LLC (Google Cloud Storage), which holds the pages of a Firm's documents only while a separately enabled bulk read is in progress and is off by default; Google LLC (Google Analytics), which measures visits to Taxably's websites after a visitor accepts analytics cookies and whose provider does not commit its processing to a location; and Calendly LLC, which schedules product demonstrations booked on taxably.ai/demo. No change to which Subprocessor reads a document by default.
• 2026-09-25: Described connected AI assistants: questions and answers that pass through Taxably's connection service on Amazon Web Services are held in memory only and not stored, and an assistant connected through a Firm's Taxably account receives account information only. Named files attached to applications among the data held on Amazon Web Services, and widened the Vercel row to every Taxably web host and its consent-gated page-view measurement. Data Processing Addendum obligations remain unchanged.
• 2026-09-24: Distinguished the default individual-document path from separately enabled bulk processing and the provider training restriction from retention conditions. No Subprocessor added or removed. Data Processing Addendum obligations remain unchanged.
• 2026-09-12: Corrected a reference. The sentence about where processing happens pointed at the Subprocessors "above" it, and the table it means is below it. No Subprocessor added, removed or changed, and no change to what any of them does.
• 2026-09-10: Added Google LLC (Google Cloud Run), which hosts the credential service that gives a paired computer permission to have its documents read. It receives no document content. The same service previously ran on Amazon Web Services. No Subprocessor removed, and no change to which Subprocessor reads a document.
• 2026-09-02: Amazon Web Services no longer receives the contents of submitted tax documents. The path that held a copy of each document on Taxably's infrastructure for the length of a read was retired; pages now travel from the Firm's own computer directly to the document-processing Subprocessor. No Subprocessor added or removed.
• 2026-09-02: Wording aligned with the copy kept beside the service, which is the authoritative one; no Subprocessor added or removed.
• 2026-08-21: Named the United States multi-region document reading is pinned to (us). No Subprocessor added or removed.
• 2026-08-15: Added Google LLC (Google Cloud Vertex AI), PostHog, Better Stack, and Cloudflare.
• 2026-05-31: Initial published list.

Questions

For questions about this list or about Taxably's data protection practices, contact legal@taxably.ai.