Sub-processors
Last updated 10 November 2026
The other companies that handle data for Octotax for Accountants, what they do and where. We keep this list short and tell you before it changes.
What changed on 10 November 2026
When your firm uses Octotax for Accountants, we process your clients' personal data on your behalf under our data processing agreement. Octotax itself runs on equipment we operate in the United Kingdom, and your firm's data is stored there. The companies below help us run the service. Each one is bound by a contract that protects the data it handles.
| Sub-processor | What it does | Data it handles | Where | Safeguard outside the UK |
|---|---|---|---|---|
| Cloudflare, Inc. | Network and security service in front of Octotax: protection from attacks, secure connections (TLS), DNS, and forwarding of email sent to octotax.co.uk addresses. | Everything sent between a browser and Octotax passes through Cloudflare in transit. Cloudflare decrypts traffic at its network edge to filter attacks, then sends it on to our equipment over an encrypted tunnel, so this can include any client data shown in the app or client area, uploaded files and IP addresses. It doesn't store your data beyond short-lived logs and caches. Emails sent to our addresses are forwarded through it. | Global network, including the US | UK extension to the EU-US Data Privacy Framework (Cloudflare is certified), with the UK Addendum to the EU standard contractual clauses in its data processing terms as a fallback. |
| Google LLC (Google Drive) | Off-site storage of nightly database backups. | Backup files containing all the data held in Octotax. They're encrypted on our equipment before upload, and Google doesn't have the key, so it can't read them. Backups are kept for 30 days. | Google's global infrastructure | UK extension to the EU-US Data Privacy Framework (Google is certified). The files are encrypted before they leave the UK. |
| Resend | Delivering email sent by the platform: sign-in codes, invitations and notifications, plus email to your clients when you haven't connected your own mail server. | Recipient names and email addresses, the content of each email (which can include client names, deadlines and links to the client area), and delivery events. Our account sends from Resend's EU region; Resend is a US company and its staff may access data from the US to provide support. | European Union, with support access from the US | The international transfer safeguards in Resend's data processing agreement (the EU standard contractual clauses with the UK Addendum, or the UK extension to the Data Privacy Framework where Resend is certified). |
| Stripe | Taking subscription payments by card or Bacs Direct Debit. | Your firm's billing contact name, email address, billing address, payment details and number of seats. Stripe doesn't receive your clients' data. (Stripe is the controller of some payment data for its own legal duties, such as fraud checks.) | UK, EU and US | UK extension to the EU-US Data Privacy Framework (Stripe is certified), with the standard contractual clauses in Stripe's data processing agreement. |
Not sub-processors, but worth knowing
- Companies House. When you search for a company or sync a client, we send the company name or number to the Companies House public API and receive the public register entry back. We don't send it your clients' private details.
- Your own mail server. If you connect your firm's mailbox (Settings, Integrations), email to your clients is sent through that provider instead of Resend. That provider works for you, under your own contract with it.
- Browser push services. If a client switches on phone or browser notifications in their client area, notifications are delivered through the push service their own browser uses (for example Apple, Google, Microsoft or Mozilla). We encrypt each notification so the push service can't read it, and notifications never include amounts or tax references.
- The free Octotax app. When one of your clients links their Octotax app to your firm, Octotax is the controller of the app's own data, not your processor. Section 3 of the data processing agreement explains how that works.
Where data goes outside the UK
Your data is stored in the UK. Where a sub-processor handles it outside the UK, the transfer is covered by UK adequacy regulations where they apply (including the UK extension to the EU-US Data Privacy Framework for certified US companies), or by the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. The table shows which applies to each. Section 12 of the data processing agreement explains this in more detail.
How we tell you about changes
Before we add or replace a sub-processor that will handle your clients' personal data, we'll email your practice owner at least 30 days in advance and update this page. If you have a reasonable data protection objection, tell us within that time and we'll work with you to resolve it. If we can't, you can close your account before the change takes effect and we'll refund any fees you've paid for the period after it.
Questions about any of this? Email [email protected].