Sub-Processors

Sub-Processors

Third-party service providers that process personal data on Fingro's behalf

Version 1.1 · Effective June 25, 2026 · Back to Security

Fingro AI, Inc. uses a small number of third-party service providers ("sub-processors") to deliver the Fingro service. Each sub-processor is bound by contract to handle personal data consistent with Fingro's Privacy Policy and Data Processing Agreement, and to apply security controls at least as protective as Fingro's own.

Customers will receive at least 30 days' advance notice of material additions or substitutions before any new sub-processor begins processing personal data. Enterprise customers can subscribe to email notifications by writing to privacy@fingro.ai.

Active sub-processors

Amazon Web Services (incl. AWS Bedrock, GuardDuty Malware Protection for S3)

Purpose

Compute, storage, encryption, networking, AI inference, vault malware scanning

Data shared

All customer data, hosted entirely within Fingro's AWS Virtual Private Cloud

Location

United States — us-east-1 primary, us-west-2 disaster-recovery copy

Contract

AWS Customer Agreement + AWS Data Processing Addendum

Anthropic (accessed via AWS Bedrock)

Purpose

Large-language-model inference (Claude models) for the WelX AI assistant, transaction categorization, summarization, and analysis

Data shared

User-typed prompts, transaction descriptions, and conversation context. Invoked via Bedrock IAM auth from within Fingro's VPC; no API keys leave AWS. Anthropic does not retain Bedrock customer prompts or outputs and does not use them for model training.

Location

United States — Bedrock cross-region inference profiles in us-east-1, us-east-2, us-west-2

Contract

AWS Bedrock customer agreement (Anthropic data terms incorporated via AWS)

Google Cloud Vertex AI (Gemini 2.5 Flash)

Purpose

AI document understanding (OCR) — extracting structured text from uploaded financial documents (tax forms, statements, identity documents) into machine-readable form for downstream parsing

Data shared

Document images and the extracted text returned by the model. Authenticated via a Google service account whose credentials are stored in AWS Secrets Manager. Google does not use the content for model training.

Location

United States — us-central1

Contract

Google Cloud Master Agreement + Google Cloud Data Processing Addendum

Perplexity AI

Purpose

Web-search augmentation for WelX answers that require current public information (e.g., market commentary, news, tax-rule lookups)

Data shared

Public-information query strings only. No personal financial data is sent to Perplexity.

Location

United States

Contract

Perplexity API Terms of Service (commercial)

Plaid

Purpose

Customer-initiated aggregation of bank, brokerage, and credit accounts

Data shared

Bank account credentials (via Plaid Link OAuth — Fingro never sees the credentials), account metadata, balances, transactions, holdings

Location

United States

Contract

Master Services Agreement, signed 2026-04-23

Teller

Purpose

Customer-initiated aggregation of bank, brokerage, and credit accounts (alternate aggregator path for select institutions)

Data shared

Bank account access tokens (issued via Teller Connect), account metadata, balances, transactions

Location

United States

Contract

Teller API Terms of Service (commercial)

Stripe

Purpose

Subscription billing and payment processing

Data shared

Customer name, email, billing address, payment card data (Stripe-tokenized — Fingro never receives card numbers)

Location

United States

Contract

Stripe Services Agreement + Data Processing Addendum

Resend

Purpose

Transactional email delivery (account activation, password reset, MFA codes, billing receipts, employer invitations)

Data shared

Recipient email address, email subject, and email body content

Location

United States

Contract

Resend Data Processing Addendum

Finnhub

Purpose

Public market data (stock quotes, fundamentals) for user-curated watchlists and investment holdings

Data shared

Ticker symbols selected by the user. No personal financial data is sent to Finnhub.

Location

United States

Contract

Finnhub API Terms of Service (commercial)

Operationally relied upon, not sub-processors

These vendors are part of Fingro's stack but do not receive personal data from the Fingro service in production:

  • Amazon Simple Email Service (SES) — Provisioned inside Fingro's AWS VPC as an alternative transactional email path. The SES production-access request is pending AWS approval; SES is not currently routing customer email. Will replace Resend once approved and rolled out, and this page and the Privacy Policy will be re-versioned at that time.
  • Microsoft 365 — Used internally for Fingro corporate email and business productivity; customer data is not stored or processed in Microsoft 365.
  • Cloudflare — DNS resolution only; no application data flows through Cloudflare.
  • GitHub — Source code repository and CI/CD; no customer data is ever stored in GitHub.

Change management

  1. Internal vendor review against Fingro's vendor management criteria (data residency, security posture, contractual fit, sub-processing chain).
  2. Data Processing Agreement executed with the new vendor before any data flows.
  3. At least 30 days' advance notice to customers via email and an update to this page.
  4. Privacy Policy updated to reflect the new sub-processor.
  5. This page is re-versioned (header above) with a changelog entry.

Contact

Sub-processor or privacy questions: privacy@fingro.ai. Security questions: security@fingro.ai.