Mast Finance Sàrl. Effective date: 22 October 2026. Version 1.0
English version. This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails.
Mast Finance Sàrl ("Mast Finance", "Mast") engages the following third-party subprocessors to provide components of the Service. This page is maintained in accordance with our Data Processing Agreement.
Customers may object to a new or replacement subprocessor on reasonable and documented data protection grounds within 14 days of the relevant update being published on this page, as described in our DPA. Where a subprocessor must be replaced urgently (to protect the security of Customer Data, to keep the Service available, or to comply with a legal obligation), the replacement may start before that period has run; this page is then updated at once and the objection period runs from that update.
Current Subprocessors
| Subprocessor | Purpose | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services (AWS EMEA Sàrl, Luxembourg) | Cloud infrastructure: hosting, storage, compute, transactional email delivery (SES), content delivery (CloudFront), and AI inference via AWS Bedrock (Anthropic Claude and Cohere models accessed as part of the managed Bedrock service, powering Mast AI: in-app help, financial analysis, report generation, and RAG reranking). | Customer Data (financial and accounting records), Service Data, AI prompts and completions, transactional email content. | Customer Data is stored in Switzerland (eu-central-2, Zurich). AI inference runs in Zurich or in one of six EU regions (Frankfurt, Stockholm, Milan, Spain, Ireland, Paris) that AWS chooses for each request; Cohere reranking runs in EU (Frankfurt, eu-central-1). Transactional email (SES) runs in EU (Ireland, eu-west-1); account emails from the authentication service (verification codes, password resets) are sent via SES in EU (Frankfurt, eu-central-1). Backups of the production database stay in Switzerland (Zurich) and are kept 12 months, with a locked copy in a separate Mast account there. Where a customer enables bill reception by email, inbound messages and attachments are held transiently (at most 7 days) by SES/S3 in EU (Ireland, eu-west-1), because SES email receiving is not offered in Zurich. CloudFront delivers static assets and may route the Service's traffic, Customer Data included, encrypted and without storing it, through the edge location nearest to the user, which can be outside Switzerland. | Single AWS Data Processing Addendum, with its Swiss addendum. Transfers within Switzerland and the EU; EU-region processing covered by the Switzerland–EU adequacy decision. AWS does not use Bedrock inputs or outputs to train models. |
| Stripe, Inc. | Payment processing, billing, and subscription management for Mast's own subscription (Mast is the merchant of record). | Billing contact data, payment status, subscription details. No Customer Data (financial or accounting records) is transmitted. | EU / United States (billing contact data only). | Certified under both the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. As a Swiss controller, Mast relies on the Swiss-US Data Privacy Framework for transfers to the United States. |
| Microsoft Corporation (Microsoft 365 / Graph) | Email send and receive on the customer's behalf via Microsoft Graph OAuth, where the customer connects a Microsoft mailbox to the email integration. | OAuth tokens and email message content and metadata for connected mailboxes. | European Union / United States, depending on the customer's Microsoft tenant region. | Microsoft's Data Protection Addendum and Standard Contractual Clauses; EU-US Data Privacy Framework and Swiss-US Data Privacy Framework for US transfers. |
| Microsoft Ireland Operations Ltd (Azure AI Document Intelligence) | Text recognition (OCR) on scanned or photographed bills, receipts and expense documents whose text cannot be read directly, so that the Service can read their amounts, dates and references. A born-digital PDF is read inside the Service and is never sent. In use since 18 September 2026. | Customer Data: the image or PDF of the document and the text recognised in it (supplier names, amounts, references, bank details, and whatever else the document shows). | Switzerland (Azure Switzerland North, Zurich). The document is processed in that region; Microsoft keeps it and the result there for at most 24 hours, then deletes them. | Microsoft Products and Services Data Protection Addendum. No transfer outside Switzerland. Microsoft does not use the documents to train or improve its models. |
| Anthropic, PBC (San Francisco, United States) | AI assistance (Claude) used by Mast Finance staff to deliver support, onboarding, data import and setup, and to diagnose and maintain the Service, under Anthropic's commercial terms. Separate from Mast AI, which runs on AWS Bedrock as described above. | Customer Data and Service Data, limited to what a given task requires (for example accounting records, documents, identification and contact details, technical logs). No special-category data is sought. | United States. Anthropic processes the data to answer and keeps it for at most 30 days (longer only where the law or the prevention of misuse requires), then deletes it. | Anthropic's Data Processing Addendum, which incorporates the Standard Contractual Clauses, with the adaptations required for transfers from Switzerland. Anthropic does not use the data to train its models. |
| PostHog, Inc. | Product analytics — usage events, feature adoption, and (where enabled) anonymised session recordings with masked input fields. Consent-gated. Processes Service Data only; no Customer Data is transmitted. | Service Data (telemetry, usage events, masked session recordings). IP addresses are not collected. | EU (Frankfurt, eu-central-1) via PostHog Cloud EU. | Standard Contractual Clauses in place. Data resident in the EU. |
| Functional Software, Inc. dba Sentry | Error monitoring and performance monitoring — stack traces and technical metadata. No personal data is collected by default; email addresses in error messages are redacted before transmission. | Technical stack traces and metadata (Service Data). | EU (Frankfurt) via Sentry Cloud EU region. | Standard Contractual Clauses in place. Data resident in the EU. |
| External developers, Switzerland or a country the Swiss Federal Council recognises as adequate (independent contractors engaged by Mast Finance; natural persons, identity provided on request; the countries are listed in the Privacy Policy) | Development, maintenance, diagnosis, and support of the Service. Access to an environment containing customer or tester data is opened case by case by written notice naming the environment, the scope, and an expiry date of at most 12 months, and is revocable at any time. The processing is purely technical: contractors are not engaged to analyse, enrich, extract, or otherwise exploit personal data, and encounter it only incidentally to that work. | Customer Data and Service Data, limited to what a given task requires: identification and contact details, authentication metadata (never passwords in clear text), activity and audit records, support correspondence, and customers' accounting records. No special-category data is sought. | Switzerland or a country the Swiss Federal Council recognises as providing adequate data protection for all organisations there (listed in the Privacy Policy). Contractors may reach customer or tester data only from those countries, including while travelling. | Written services contract with a processor annex under art. 28 GDPR and art. 9 revFADP, confidentiality backed by a contractual penalty, professional liability insurance required before any access to real data, and no onward subprocessing without Mast's prior specific written authorisation. |
We list this category before any such access is opened, so that the 14-day objection period described above runs ahead of the event rather than after it. Individual contractors are not named here because they are natural persons; we identify the contractor engaged at any given time to any customer who asks.
Planned / Not Yet Active
Not yet active: the integration is built, but no data is sent to the subprocessors below yet. Each one moves to the current subprocessors, with a line in the changelog, on the day it receives its first data.
| Subprocessor | Purpose | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| SIX BBS AG (Zurich) | bLink, SIX's open banking platform: passes to Mast the balance and booked transactions of the bank accounts a customer connects and, where the Service offers it, passes the customer's payment orders to its bank; keeps, on Mast's behalf, the access token the bank issues when the customer consents (Consent-as-a-Service). Mast's admission to bLink is under way and the connection is switched off. | Customer Data: account identifiers and holders, balances, booked transactions (counterparties, amounts, references), payment orders (each beneficiary's name, address and account, the amount, the reference); the bank's access token; the IP address and browser of the user on the operations the user starts. | Switzerland. SIX passes the data on without keeping or analysing their content. | bLink participation contract and Consent-as-a-Service contract with SIX. No transfer outside Switzerland. |
Customer-Directed Merchant Data Sources
The following are integrations the customer authorises and connects, so that Mast can pull the customer's own sales and transaction data into the Service on the customer's instruction. Mast does not control the data held in these platforms and does not engage them as its own subprocessors; the customer's relationship with each provider is governed by that provider's own terms. They are listed here for transparency.
| Provider | Purpose | Characterisation |
|---|---|---|
| PayPal | Import the customer's own PayPal sales and transaction data. | Customer-directed data source connected via the customer's own credentials/OAuth. Not a Mast sub-processor of Mast-controlled data. |
| Shopify | Import the customer's own Shopify order and sales data. | Customer-directed data source connected via the customer's own credentials/OAuth. Not a Mast sub-processor of Mast-controlled data. |
| WooCommerce | Import the customer's own WooCommerce order and sales data. | Customer-directed data source connected via the customer's own credentials/OAuth. Not a Mast sub-processor of Mast-controlled data. |
Changes
This page will be updated before any new subprocessor is engaged, or at once in the case of an urgent replacement described in our DPA. A changelog of changes is maintained below.
| Date | Change |
|---|---|
| 11 October 2026 | Version 1.0. |
| 14 October 2026 | Anthropic, PBC added (AI assistance for Mast Finance staff). |
| 15 October 2026 | Urgent replacement of a subprocessor described (DPA §8). |
| 19 October 2026 | AWS row: where Mast AI inference runs, restated (Zurich or one of six EU regions chosen by AWS for each request; reranking in Frankfurt). |
| 22 October 2026 | SIX BBS AG (bLink): planned subprocessor row brought up to date (contracting entity, data, location); not yet active. |
| 22 October 2026 | External developers: they may work from Switzerland or from a country the Swiss Federal Council recognises as adequate for all organisations there (listed in the Privacy Policy), no longer only from Switzerland or the EU. |
| 22 October 2026 | AWS row: CloudFront may also route the Service's traffic, Customer Data included, encrypted and without storing it, through the edge location nearest to the user. |
Contact
For questions about our subprocessors, please contact us at contact@mastfinance.io.
Language
This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails. A rendering in any other language is provided for information only.
Mast Finance Sàrl — Rue Centrale 15, 1003 Lausanne, Switzerland — contact@mastfinance.io