Subprocessors
Last updated 23 July 2026
Invoice Forever does not run its own servers. These five companies process data on our behalf so the service works. There are no others, and this page is the authoritative list.
| Provider | What it does | What it touches | Where it runs | Transfer basis |
|---|---|---|---|---|
| Convex | Application database and backend | Account details, invoices, clients, saved items, settings | European Union | No transfer outside the EEA |
| DigitalOcean Spaces | File storage | Files you upload, such as a business logo | Amsterdam, Netherlands | No transfer outside the EEA |
| Netlify | Website hosting and delivery | Request metadata such as IP address and browser, as any web server sees | United States (global edge network) | Standard Contractual Clauses |
| Resend | Transactional email | Your email address and the contents of service emails, such as verification, password resets and invoices you choose to send | United States | Standard Contractual Clauses |
| PostHog | Anonymous usage and error statistics | Page URL, referrer, approximate country, browser, error details. No account identifier and no invoice content | European Union (PostHog EU Cloud) | No transfer outside the EEA |
Where your data actually sits
The two providers holding the substance of your account, the database and your uploaded files, are both in the EU: Convex in the European Union and DigitalOcean Spaces in Amsterdam. Your invoices and client records do not leave the EEA.
Netlify and Resend are United States companies. Netlify serves the website itself and therefore sees ordinary request metadata such as your IP address, in the way any web server does. Resend sends the service emails, so it handles your email address and the contents of those messages. Both operate under Standard Contractual Clauses. We would rather these were EU-based too, and if that becomes practical we will move them and update this page.
Changes to this list
We will publish any addition or replacement here before it takes effect, so there is always a public record of who is involved. If you rely on this for your own compliance and want to be told directly rather than checking the page, email hello@invoiceforever.com and we will add you to the notification list.
Related
Our processor obligations to you are set out in the data processing agreement. What we collect and why is in the privacy policy, and cookies covers what is stored in your browser.