Sub-processors
Version: July 9, 2026
This is the current list of sub-processors — the external providers Alastia SLU (Tributs) relies on to provide the service. We keep it up to date on this page and version its date in the header.
With each one we have a signed Data Processing Agreement (DPA) imposing the same data-protection obligations (art. 31.5 of Llei 29/2021) and, for transfers outside the European Economic Area, appropriate safeguards (Standard Contractual Clauses, arts. 42 to 45 LQPD).
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| OpenRouter, Inc. | Single generative-AI gateway (invoice scanner, bank-movement categorisation and help assistant). Routed with Zero Data Retention (ZDR) enabled; prompts and responses are not retained at the gateway. | Estats Units · EEUU | Standard Contractual Clauses (SCCs) + ZDR |
| Anthropic, PBC | AI models (Claude) via OpenRouter: bank categorisation, help assistant and invoice-scanner fallback. | Estats Units · EEUU | Standard Contractual Clauses (SCCs) + ZDR (via OpenRouter) |
| xAI, LLC | AI models (Grok) via OpenRouter: structured invoice data extraction (scanner). | Estats Units · EEUU | Standard Contractual Clauses (SCCs) + ZDR (via OpenRouter) |
| Hetzner Online GmbH | Hosting of servers and databases. | Alemanya · UE | UE (intra-EEE) |
| Cloudflare, Inc. | DNS, CDN, DDoS mitigation and encrypted attachment storage (R2, EU region). | Estats Units · EEUU | Standard Contractual Clauses (SCCs) |
| Resend, Inc. | Transactional email sending (verification, notifications, invoices). | Estats Units · EEUU (regió d'enviament UE) | Standard Contractual Clauses (SCCs) |
| Vercel, Inc. | Hosting of the tributs.ad landing and anonymous analytics. | Estats Units · EEUU | Standard Contractual Clauses (SCCs) |
| Functional Software, Inc. (Sentry) | Software error diagnostics (no document content). Configurable from /perfil → Error diagnostics. | Regió UE (ingest a Frankfurt) · matriu EEUU | SCCs + regió d'ingest UE |
Changes and right to object
If you act as a data controller (for example, an accounting firm or a business processing its customers', suppliers' or employees' data with Tributs), we will inform you of any addition or replacement of a sub-processor with at least 30 days' notice, by publishing the updated version on this page and notifying you by email.
During that period you may object on reasonable data-protection grounds (art. 31.3 of Llei 29/2021); if the objection is well-founded and there is no reasonable alternative, you may terminate the service without penalty for the unused portion.
The full framework of this relationship is set out in the Data Processing Agreement (DPA). The categories of recipients, from the data subject's perspective, are described in the Privacy policy.