Subprocessors
PILOTLAB LLC uses a small number of trusted service providers to run PilotLedger. This page lists every third party that processes personal data on our behalf. Effective October 13, 2026.
Effective October 13, 2026 · PilotLedger is a product of PILOTLAB LLC
1. What a subprocessor is
When a business uses PilotLedger, it is the controller of the records it keeps in its books, and we process that data on its behalf under our Data Processing Addendum. A subprocessor is a third party we engage to help us provide the service that may process that personal data, or personal data about our own account holders and website visitors.
Before we engage a subprocessor, we assess its security and privacy practices, and we sign a written contract that requires it to protect the data, use it only to provide its service to us and meet obligations at least as protective as those in our DPA. We remain responsible for our subprocessors' performance.
2. Current subprocessors
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, content delivery and privacy-friendly web analytics | All application data in transit and request logs (IP address, user agent) | United States |
| Managed MySQL database provider | Primary database for accounts and accounting records | All customer account and accounting data, encrypted at rest | United States |
| Stripe, Inc. | Subscription billing and payment processing | Billing name, email, card details (collected directly by Stripe), invoices | United States |
| Resend (Plus Five Five, Inc.) | Sending transactional email: verification, password reset, invoices and reminders you send to your customers | Email addresses, names and email contents | United States |
| Google LLC (Google Analytics) | Website usage analytics, only after you accept analytics cookies | Pseudonymous identifiers, pages viewed, device and approximate location | United States |
All of our servers and databases are located in the United States. Where personal data from the EEA, the UK or Switzerland is transferred, we rely on Standard Contractual Clauses as described in the Data Processing Addendum.
Google Analytics only processes data from visitors who accept analytics cookies on our website. It does not receive Customer Data from inside the PilotLedger app. See our Cookie Policy.
3. Services that are not subprocessors
- Public exchange rate services, such as the Frankfurter API, provide daily currency rates. Our servers request rates without sending any personal data.
- Images on some older blog posts load from images.unsplash.com. Unsplash can see the IP address of visitors who view those posts, but receives no account or Customer Data.
4. How we notify changes
When we add or replace a subprocessor, we update this page and the "Last updated" date at the top.
Customers who have signed our Data Processing Addendum can subscribe to advance notice by emailing support@pilotledger.net with the subject "Subprocessor updates". Subscribers will receive notice at least 14 days before a new subprocessor begins processing their Customer Data, and may object on reasonable data protection grounds as set out in the DPA.
5. Questions
For questions about our subprocessors or to request a copy of our DPA, contact PILOTLAB LLC at support@pilotledger.net or +1 888 370 6801. You can also read our Privacy Policy and our Security page.