Sub-Processors
This page lists the sub-processors that Firma Kimmo Björnsson (“BottomUp”) engages to process personal data on behalf of its customers (the data controllers). It is published in accordance with Section 6 of the Data Processing Agreement.
Transfers to third countries are made on the basis of the European Commission’s Standard Contractual Clauses (SCCs), supplemented where required by additional safeguards (Transfer Impact Assessment, TIA).
Notice and objection procedures for changes to this list are set out in Section 6 of the Data Processing Agreement.
Current Sub-Processors
| Sub-processor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Google Cloud Platform (Google Ireland Limited) | Application infrastructure, database, data warehouse, file storage, background jobs, logging | EU (europe-west1) | EU primary processing; intra-group SCCs apply for any access by US-based Google entities |
| Redis Cloud (Redis Ltd.) | Session and distributed cache | EU (europe-west1, GCP) | SCCs + TIA |
| Mailgun (Mailgun Technologies, Inc., Sinch group) | Transactional email (welcome, invitation, password reset) | EU (api.eu.mailgun.net) | SCCs + TIA |
| Cloudflare Turnstile (Cloudflare, Inc.) | Bot and CAPTCHA protection on sign-up and sign-in | Global CDN | SCCs + TIA |
| Anthropic Claude API (Anthropic, PBC) | AI-based analysis and chat over financial data | USA | SCCs + TIA |
| Enable Banking Oy | PSD2 aggregation of bank account data (balances, transactions) | EU | EU primary processing; no known third-country transfers |
Changes
| Date | Change | Notice given |
|---|---|---|
| 2026-05-03 | Initial publication | – |