Draft — not yet in effect
Subprocessors
Drafting note
Public list. Draft v0.1 · 2026-09-24 · not yet published. Published at https://sidesheet.co/legal/subprocessors. Referenced by the Terms (§8), the Privacy Policy, and the §7216 consent templates.
UNTAP LLC uses the following third parties to provide the service. Each is bound by a written agreement that restricts its use of customer data to providing its service to us, and we remain responsible for their performance.
"Return content" means uploaded tax-return files and the data extracted from them.
| Subprocessor | Purpose | Data processed | Receives return content? | Location |
|---|---|---|---|---|
| Google LLC (Google Cloud) | Application hosting (Cloud Run); AI document extraction (Vertex AI) | Return content during processing; operational logs (no return content) | Yes | United States (us-central1) |
| Supabase, Inc. (infrastructure on Amazon Web Services) | Database, user authentication, file storage | Return content (stored files and spreads); account data (names, emails) | Yes | United States (region: us-west-2 (Oregon)) |
| Twilio Inc. (SendGrid) | Account emails: sign-in links and codes, invitations, notifications. Click and open tracking off | Account data (names, email addresses) | No | United States {{VERIFY}} |
| Stripe, Inc. (Stripe) | Payment processing (billing) | Admin email address; payment details entered at checkout or in the billing portal. We keep only Stripe customer and subscription ids and billing dates | No | United States |
Changes
We give customers at least 30 days' notice before adding or replacing a subprocessor, by email to each customer's admins and by updating this page. A customer may object in writing during that period; if we cannot reasonably accommodate the objection, the customer may terminate and receive a pro-rata refund of prepaid fees (Terms §8).
§7216 note for CPA firms: our consent templates name every subprocessor that receives return content. A new one that receives return content is not covered by consents your clients have already signed; the 30-day notice exists partly so you can collect updated consents.
History
| Date | Change |
|---|---|
| {{PUBLISH_DATE}} | Initial list |
Last updated: {{PUBLISH_DATE}}