This page lists every third party that processes customer data on Talisk's behalf ("sub-processors"), and, separately, the services data flows to at your direction when you connect them. It is referenced by our Privacy Policy and Data Processing Agreement, and is updated when the list changes.
01Sub-processors (engaged by Talisk)
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting (application servers and database), and object storage for the documents you upload and for encrypted backups | All service data (encrypted at rest as described on the Security page) | United States (Santa Clara, CA) |
| Anthropic, PBC | AI features — inbox triage, drafting, document extraction, bookkeeping assistant. No training on your data; no default retention of API content | Email content and metadata, document images, and financial figures involved in the specific AI request | United States |
| Stripe, Inc. | Subscription billing and payment processing (Talisk never stores card numbers) | Name, email, payment details, billing history | United States |
| Brevo (Sendinblue SAS) | Transactional email relay (verification, password reset, invite emails, scheduled report delivery, account alerts) | Recipient email address and message content of those service emails | European Union (France) |
| Cloudflare, Inc. | Network protection and delivery for taliskhq.com and talisk.ai: every request to the Service passes through Cloudflare, which filters attacks and abusive traffic and forwards the rest to our servers over an encrypted connection. Also runs the Turnstile bot check on the sign-in and sign-up screens (tells a person from an automated password-guessing script) | IP address, browser and device characteristics, and the content of requests and responses as they pass through (processed in transit, not stored as account data); interaction signals collected by the Turnstile check | United States (global network) |
| Functional Software, Inc. (Sentry) | Error tracking. When the Service hits an unexpected error, a crash report is sent so we can find and fix the cause. Reports come from our servers and from the app running in your browser, and each is scrubbed before it is sent | Error stack traces and request metadata: the error type and message, where in our software it happened, the page or API route and its HTTP method, the software version, the time, and a short trail of what the server did just before (for example a call to a provider's API, with web addresses scrubbed). Personal data and credentials are removed before sending: no request bodies, cookies, sign-in headers, IP addresses, variable values or user identifiers, and secret parts of web addresses and any email address in an error message are masked. A browser report also carries the page address (secret parts masked, anything after a question mark removed), the browser and operating system, and the pages visited just before; it carries no form contents, no console output, no on-screen content beyond the error's own technical message, and there is no screen recording or performance tracing. Reports are kept for 30 days | United States |
02Connected services (at your direction)
These are not engaged by Talisk — data flows between Talisk and them only when you connect the integration, and each operates under its own terms and privacy policy. Disconnecting the integration (in Talisk, or by revoking access at the provider) stops the flow.
| Service | What the connection does | Data categories | Location |
|---|---|---|---|
| Google LLC | Gmail mailbox sync and Google Contacts sync (Gmail + People APIs) | Email content and metadata, contacts | United States |
| Microsoft Corporation | Outlook mailbox and contact sync (Microsoft Graph) | Email content and metadata, contacts | United States |
| Plaid Inc. | Bank account connections for transaction import and reconciliation | Bank account details, balances, transactions | United States |
| Shopify Inc. | Ecommerce sales and payout import, and creating a customer in your store when you ask us to | Orders, payouts, product/cost data. Customer name, email, phone and address when you create a customer | Canada |
| WooCommerce (your own store) | Ecommerce sales import from your self-hosted store | Orders and payout data from your store | Wherever your store is hosted |
| Block, Inc. (Square) | Point-of-sale payout import | Payout and settlement data | United States |
| PayPal, Inc. | Payment-processor settlement import | Transaction and settlement data | United States |
| Stripe, Inc. (the Talisk HQ Stripe App, and Stripe Connect) | Payment-processor payout import (through the Talisk HQ Stripe App, read-only) and invoice payments, if you connect your own Stripe account | Payout, settlement, and invoice-payment data | United States |
03Changes
When we add or replace a sub-processor, we update this page before the new sub-processor begins processing customer data. DPA customers can subscribe to change notices — see the Data Processing Agreement.