Sub-processors
Last updated: 25 October 2026
Operator: UAB "Solario projektai"
Company code: 304156786
Address: Subačiaus g. 17-10, LT-01300 Vilnius, Lithuania
Contact: business@claister.com
These are the companies Claister uses to process personal data on behalf of the accounting firms that use it, as described in the Data Processing Agreement. We announce a new or replacement sub-processor here and to workspace owners at least 30 days before it starts.
Announced on 23 October 2026: Hetzner will replace Railway for hosting, not before 24 November 2026. A workspace owner who objects on data protection grounds can tell us at business@claister.com until then. Cloudflare, announced the same day, keeps encrypted backup copies from 24 October 2026: Claister then held only test workspaces, so no customer's data reached it with less than the 30 days' notice.
Announced on 25 October 2026: Mistral AI will read the text of scanned documents and photos when AI is on. It starts only when scan reading is switched on; while Claister holds only test workspaces it may start before the 30 days have passed, and once a firm's own data is in Claister a later start keeps the 30 days' notice.
Railway Corporation
- Purpose
- Hosting of the application, databases, file storage, virus scanning and backups
- Personal data
- All workspace data
- Location
- European Union (EU West, Amsterdam, Netherlands)
- Transfer safeguard
- Data stays in the EU; standard contractual clauses for remote support access from the United States
- Used
- Until the move to Hetzner, not before 24 November 2026
Hetzner Online GmbH
- Purpose
- Hosting of the application, databases, file storage, virus scanning and backups, replacing Railway
- Personal data
- All workspace data
- Location
- European Union (Germany and Finland)
- Transfer safeguard
- Data stays in the EU with an EU company
- Used
- From 24 November 2026 at the earliest (announced 23 October 2026)
Cloudflare, Inc. (R2 storage)
- Purpose
- Keeping encrypted copies of the database backups and stored files outside the hosting provider, for recovery
- Personal data
- Encrypted copies of all workspace data, which Cloudflare cannot read
- Location
- European Union (EU jurisdiction storage)
- Transfer safeguard
- Data is stored in the EU; EU-US Data Privacy Framework or standard contractual clauses for access from the United States
- Used
- From 24 October 2026 (announced 23 October 2026)
Resend (Plus Five Five, Inc.)
- Purpose
- Sending email: sign-in codes, invitations, requests, reminders and messages to clients
- Personal data
- Names, email addresses and the content of those emails
- Location
- United States
- Transfer safeguard
- EU-US Data Privacy Framework or standard contractual clauses
- Used
- Always
OpenAI
- Purpose
- AI features: the assistant, drafts, document reading, voice transcription and web search
- Personal data
- The content a person sends to an AI feature, filtered by their access
- Location
- United States
- Transfer safeguard
- Standard contractual clauses (OpenAI Ireland Ltd.); requests are made with storage turned off
- Used
- When AI is on in the workspace
Vercel, Inc. (AI Gateway)
- Purpose
- Routing AI requests to the model provider named for them, such as OpenAI, which handles them under its own entry
- Personal data
- The content a person sends to an AI feature, filtered by their access, and short excerpts such as message text and file names for classification
- Location
- United States
- Transfer safeguard
- EU-US Data Privacy Framework or standard contractual clauses
- Used
- When AI is on in the workspace
Mistral AI SAS
- Purpose
- Reading the text of scanned documents and photos (OCR), so they can be searched and used by the AI features
- Personal data
- The bytes of a scanned file or photo, without its name
- Location
- European Union (France)
- Transfer safeguard
- An EU company subject to the GDPR
- Used
- When AI is on and scan reading is switched on (announced 25 October 2026)
Boat (boat.dev)
- Purpose
- A temporary computer on which the assistant prepares spreadsheets and documents a person asked for
- Personal data
- The data the assistant uses for that file
- Location
- To be confirmed
- Transfer safeguard
- To be confirmed
- Used
- When AI is on and a person asks the assistant for a file
Firecrawl
- Purpose
- Reading public web pages and company registers for the assistant and client onboarding
- Personal data
- Web addresses and company names; no workspace content
- Location
- United States
- Transfer safeguard
- Standard contractual clauses
- Used
- When AI is on and a page or company is looked up
Recall.ai
- Purpose
- Recording and transcribing meetings
- Personal data
- Meeting audio and video, participant names and transcripts
- Location
- European Union (Frankfurt, Germany)
- Transfer safeguard
- Data stays in the EU
- Used
- When a person records a meeting
Services a firm connects
Services a firm connects itself, such as its email account, Telegram, Site.pro or other connectors, are not Claister's sub-processors; the firm uses them under their own terms. Google and Apple process sign-in data only when a person chooses those sign-in options.
Contact business@claister.com to be told about changes to this list by email or to ask for the safeguards in place with a provider.
Terms of Service · Data Processing Agreement · Sub-processors · Privacy policy