Legal

Sub-processors

Effective October 22, 2026

LogisAI Corporation uses a small number of third-party providers to run the service. This page lists each one, what of your data reaches it, and where that happens. It is the list the Privacy Policy and the Terms of Service refer to.

1.Current sub-processors

A sub-processor is a company that processes customer data on our behalf in order to provide the service. Each is bound by a written agreement that limits its use of the data to the purpose below.

Provider	Purpose	What it receives	Region
Oracle Cloud Infrastructure (OCI)	Hosting: application servers, the PostgreSQL database and the ledger, and object storage for uploaded documents and backups.	All customer data at rest and in processing: account records, documents, books, logs.	us-ashburn-1 — Ashburn, Virginia, USA
Cloudflare	DNS, hosting of the web applications (Pages) and the reverse proxy in front of the API, including TLS termination at the edge.	Everything in transit between your browser and our servers, decrypted and re-encrypted at the edge; request logs (IP address, URL, user agent) for the duration Cloudflare keeps them.	Global edge network; our origin is in the USA
Amazon Web Services (Simple Email Service)	Sending transactional email — welcome notes, invitations, password resets, notifications and support acknowledgements — from [email protected].	Recipient email addresses and the content of the messages we send you.	USA
Anthropic	Model inference for reading documents, coding transactions, reconciliation and answering questions about the books.	Prompts composed from document text and extracted fields, with Social Security numbers, EINs and bank account numbers replaced by tokens before sending; page images of documents sent for extraction, which are not redacted. Used through the commercial API; not used to train models.	USA
Google (Gemini API)	Model inference, the same tasks as above; the platform chooses between providers per task.	The same as for Anthropic: masked text, and unredacted page images for extraction. Used through the commercial API; not used to train models.	USA
Open Exchange Rates	Daily foreign-exchange rates for books that hold balances in more than one currency.	None of yours. We request rates by currency code only; no account or transaction data is sent.	USA / United Kingdom
BillAI (joinbillai.com)	Subscription billing and usage metering for your AccountsAI plan, and the hosted page where a payment method is added.	The name and billing email of the firm or business, jurisdiction, plan, and usage quantities (pages processed, books closed, storage). Card details are entered on BillAI's payment page and never touch our servers.	USA
Stripe	Payment rails between an accounting firm and its clients when the firm connects its own Stripe account and settles engagement invoices through the platform.	Invoice amounts, the paying business's name and email, and the firm's connected-account identifiers. Governed by the firm's own agreement with Stripe.	USA

Malware scanning of uploaded files runs on our own servers (ClamAV) and sends nothing to a third party.

2.What the AI providers see

Two kinds of material reach Anthropic and Google. First, text: the prompts that code a transaction, match a bank line or answer a question are composed from document text, extracted fields and the books. Before any of that leaves our infrastructure it passes through a masking gateway that replaces Social Security numbers, Employer Identification numbers and bank account numbers with stable tokens; the map from token to value stays with us and responses are re-hydrated here. Second, images: a page of a PDF or a photo of a receipt is sent as an image so the model can read it, and images are not redacted. Whatever is printed on that page — a name, an address, an account number on a bank statement — reaches the provider.

Both providers are used through their commercial APIs, under terms that do not permit training on our inputs or outputs, and we do not use your data to train models of our own. Masking of names and addresses in text, and redaction of document images, are not yet built; our security page says so in the same words.

3.Web fonts

Our web applications load their typefaces from font services. These companies do not receive any customer data, but when your browser fetches a font file it reveals your IP address and browser details to them, so they are listed here.

Google Fonts — used by this website, the accountant console and the customer portal.
Fontshare (Indian Type Foundry) — used by the accountant console and the customer portal.

4.Changes to this list

We update this page before a new sub-processor begins handling customer data, and we email the owner of each account at least 15 days beforehand. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may cancel the affected subscription before the change takes effect and we will refund any prepaid fees for the period after cancellation.

Questions about this list go to [email protected].