For procurement and security review
What your procurement or security team will ask before a larger contract, answered as it is today. Jithox is run by one person. Where the answer is no, this page says no.
The usual questions
| Topic | Status | Answer |
|---|---|---|
| Security questionnaire | Yes | A filled-in standard questionnaire, including every question where the answer is no. |
| Data processing agreement | Yes | The EU Standard Contractual Clauses 2021/915 with filled-in annexes. Signed on request. |
| Sub-processor list | Yes | Below on this page, identical to Annex IV of the agreement. 14 days' notice of a new one. |
| Hosting and data location | Yes | Application in Frankfurt (Vercel fra1), database in Frankfurt (Neon eu-central-1), MCP servers in Helsinki (Hetzner). Some sub-processors process outside the EU; the list says which. |
| Status page | Partly | Current availability per server. No incident history. |
| Uptime SLA | No | No financial SLA and no uptime figure: uptime is not measured, so no number is published. |
| Incident process | Partly | A published security contact (security.txt) and breach notification without undue delay under the agreement. No fixed number of hours and no 24/7 on-call. |
| Support and response time | Partly | One mailbox, and a person reads every message. No guaranteed response time. |
| Invoice in your company's name, with VAT | Partly | Your billing address and VAT number are taken at checkout and Stripe calculates the VAT, but a top-up does not create an invoice today. No payment by bank transfer or purchase order. |
| Contract terms | Partly | Plain-language terms, not reviewed by a lawyer. Governing law and courts are not stated. |
| Liability | No | The service is provided as-is, without warranties. No liability cap is published. |
| Exit and data portability | Partly | At the end of the contract you choose deletion or return (agreement Clause 10(d)). There is no self-service export: data is provided by hand. |
| Independent penetration test | No | None has taken place. Our own tests are not an independent penetration test. |
| ISO 27001 or SOC 2 | No | We hold no ISO 27001, no SOC 2 and no other certification. |
| Cyber or liability insurance | No | No proof of insurance is offered. |
Security questionnaire
About 60 standard questions, answered in one file: company, certifications, data location, data protection, technical measures, availability, incidents, support and commercial terms. Attach it to your vendor review, or send us your own form.
Sub-processors
This is Annex IV of our data processing agreement, shown here as it stands in the agreement. Where the agreement and this page could differ, they cannot: the table is read from the agreement's file.
| # | Sub-processor | What it does for Jithox | Engaged | Where (as published by the sub-processor) | Its own DPA / sub-processor list | Source in code |
|---|---|---|---|---|---|---|
| 1 | Vercel Inc. | Hosting of the website, API and app | Always | Region fra1 (Frankfurt), configured and measured | https://vercel.com/legal/dpa | vercel.json:8 |
| 2 | Neon | Postgres database for all application data | Always | eu-central-1 (Frankfurt) | https://neon.com/dpa (redirects to platform terms §3.4) | src/lib/db.ts:110-111 |
| 3 | Hetzner Online GmbH | Servers of the MCP fleet on mcp.jithox.com | Always | Helsinki, Finland (measured: AS24940) | https://www.hetzner.com/AV/DPA_en.pdf | docs/website/ZAKELIJK_AFNEMEN.md:24 |
| 4 | Clerk, Inc. | Sign-in: e-mail, name, session | Always | United States, per Clerk's own DPA (account data is processed under the EU-U.S. Data Privacy Framework; Clerk's Trust Center sub-processor list is at clerk.com/legal/subprocessors, current as of 10-07-2026) | https://clerk.com/legal/dpa | package.json (@clerk/nextjs); src/features/auth/clerk.ts |
| 5 | Stripe | Card payment and checkout: buyer name, e-mail, billing address, VAT id | Always (paid orders) | Ireland (Stripe Payments Europe, Ltd., contracting entity for a non-US account) and United States (Stripe, Inc., operational replication for fraud prevention), per Stripe's own DPA §1 and §3.2 | https://stripe.com/legal/dpa | package.json (stripe) |
| 6 | Resend | Sending e-mail and receiving inbound e-mail (addresses, message content) | Always | United States, per Resend's own sub-processor list (resend.com/legal/subprocessors); Resend's DPA (§4) names the list as authoritative | https://resend.com/legal/dpa | src/features/mcp-email/client/email-client.ts:215; src/features/workspace/inbound-email-body.ts:21 |
| 7 | OpenAI | A (MCP tools parse_receipt_vision, transcribe_and_slice_audio: receipt images and audio files) and C (drafting, receipt reading, audio transcription) | Only if OPENAI_API_KEY is set for the controller's account; the tools refuse the call otherwise | Mixed, per OpenAI's published sub-processor list for the API product (platform.openai.com/subprocessors, checked 23-09-2026): Microsoft (cloud infrastructure) is listed for 22 countries including several EU/EEA states (e.g. France, Germany, Ireland, Italy, Netherlands, Poland, Spain, Sweden), CoreWeave lists Sweden among its countries, Google Cloud Platform lists Finland and Netherlands, while Amazon Web Services is listed as United States only; the list does not state which entity or country handles a given request | ONBEKEND whether Jithox has a signed DPA with OpenAI on file (the provider's own DPA page returned HTTP 403 to our automated check on 23-09-2026); the platform.openai.com/subprocessors page above is public and does not require sign-in | src/features/hosted-draft-beta/hosted-openai-draft-transport.ts:25; src/features/mcp-plugins/plugins/receipt-vision-plugin.ts:189; src/features/mcp-plugins/plugins/transcribe-audio-plugin.ts:162 |
| 8 | Anthropic | Only in C: drafting with a model key the customer brings | Only when the controller configures an Anthropic model key | Worldwide, per Anthropic's own sub-processor list (trust.anthropic.com/subprocessors, checked 23-09-2026: AWS and Google Cloud, the underlying infrastructure for all products, are both listed with country "Worldwide", not a specific country) | https://www.anthropic.com/legal/data-processing-addendum | src/features/model-engine/model-engine.ts:67 |
| 9 | DeepSeek | Only in C: fallback model for drafting | Only if the DeepSeek fallback is configured (owner does not use it today, see PRODUCT memory) | People's Republic of China, as stated in DeepSeek's own privacy policy (cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html, "Data storage": "we directly collect, process and store your Personal Data in People's Republic of China") | ONBEKEND — DeepSeek publishes a privacy policy, not a GDPR-standard DPA or SCC package; no EU adequacy decision covers China | src/features/ai-gateway/config.ts:47; src/features/ai/deepseek.ts:25 |
| 10 | Upstash (Redis) | Rate limiting and duplicate detection | Only if configured (Upstash env vars set for the deployment) | Selectable AWS region at database-creation time (Upstash documents both EU options, e.g. eu-west-1 Ireland and eu-central-1 Frankfurt, and US options); which region the current database uses is ONBEKEND, eigenaar controleren | https://upstash.com/static/trust/dpa.pdf (sub-processor list at upstash.com/static/trust/subprocessors.pdf) | src/features/security/rate-limit-store.ts:149-150; src/features/agent-preflight/dedupe-store.ts:62-63 |
| 11 | Vercel Blob | Storage of media files | Only if used (a controller submits a receipt image/audio file or other stored media) | Covered by the Vercel DPA and the Vercel region configured for the project (see row 1: fra1, Frankfurt); Vercel Blob does not publish a separate region list from the main platform | https://vercel.com/legal/dpa | src/features/media-assets/store.ts:34 |
| 12 | Google Cloud Tasks | Queue for agent actions | Only if enabled (the owner does not use this today) | Region is a per-project GCP configuration choice; Google's Cloud DPA (cloud.google.com/terms/data-processing-addendum §10) states data may be processed in any country where Google or its sub-processors maintain facilities unless a region is pinned; which region Jithox would pin is ONBEKEND, eigenaar controleren (not configured) | https://cloud.google.com/terms/data-processing-addendum | src/features/agent-actions/google-cloud-tasks-agent-action-dispatch-queue.ts:247 |
| 13 | Sentry | Error monitoring | Only if SENTRY_DSN is set | Depends on the data-storage-location setting a Sentry customer picks at signup (EU or US region); Sentry's own sub-processor list (sentry.io/legal/subprocessors) names AWS, Google Cloud and Cloudflare as its infrastructure, each available in EU or US; which region Jithox's project uses is ONBEKEND, eigenaar controleren (not configured) | https://sentry.io/legal/dpa/ | src/features/monitoring/error-monitoring.ts:66-67 |
| 14 | Telegram | Notification that a draft is ready | Only if configured (the owner does not use this today) | For EEA/UK sign-ups Telegram states its data centres are in the Netherlands (telegram.org/privacy §"Where do we store your data"); a bot's outbound message to an existing chat runs over the same Telegram infrastructure | https://telegram.org/privacy (no separate GDPR sub-processor DPA is published for the Bot API; the Standard Bot Privacy Policy at telegram.org/privacy-tpa applies to bots without their own policy) | src/features/workspace/draft-ready-notifier.ts:83 |
| 15 | Payhip | Sale and delivery of Jithox downloads (withdrawn from sale on 2026-09-18; existing buyers keep access); sends Jithox a webhook with buyer data, of which Jithox stores the buyer e-mail only as a SHA-256 hash | Only for existing buyers of the withdrawn product; no new sales | EU, per Payhip's own privacy policy (payhip.com/privacy, "Where we store your personal data": "All information We hold about you is stored on secure servers in the EU"); the data controller, Payhip Limited, is registered in London, UK, but that is the controller's registered office, not the stated storage location | ONBEKEND — Payhip publishes a privacy policy, not a standalone GDPR DPA; no separate sub-processor list found | src/content/site/offers.ts:158-159,166; src/app/api/webhooks/payhip/route.ts:69 |
Contact for procurement
One address. Put "Procurement" in the subject, and a person reads it.
- Your company and what you want to use Jithox for.
- Your own questionnaire or contract, if you have one.
- Whether you need a signed copy of the data processing agreement.
There is no guaranteed response time, and any change to our terms is decided by the owner.