Current sub-processors
A sub-processor is a third party we engage to help provide the Service, who may process personal data on our behalf. The table below lists our current sub-processors.
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Supabase | Authentication, primary Postgres database, and file storage (e.g., uploaded supporting documents). | Account/profile data, encrypted connection tokens, application data, uploaded files, audit logs. |
| Railway | Application hosting for the web app, the MCP API server, and the background worker. | All data processed by the Service passes through infrastructure hosted on Railway. |
QuickBooks / Intuit — not a traditional sub-processor
QuickBooks Online (operated by Intuit Inc.) is the accounting platform you choose to connect — it is the original source of your client's financial data, not a vendor Fibby Ninja selected on your behalf. Fibby Ninja accesses it via Intuit's API using OAuth credentials you grant, under your own existing relationship with Intuit. We list it here for transparency, but it should be understood as your own integration choice and data source, rather than a sub-processor in the traditional sense of a vendor we chose to handle data for you.
Your own AI client (Claude, ChatGPT, etc.) — not our sub-processor
When you connect Claude, ChatGPT, or another AI client to Fibby Ninja's MCP connector, that AI client calls our MCP server directly, using credentials and an account you control. Fibby Ninja does not separately transmit your data to Anthropic, OpenAI, or any other AI provider — we have no independent relationship with those providers regarding your data, and they are not sub-processors of Fibby Ninja's. Your use of those AI clients is governed by your own agreement with their respective providers.
Planned, not yet active
A small number of additional services are referenced in our infrastructure configuration for planned functionality — for example, transactional email delivery, error monitoring, and bot/spam protection for public forms — but are not yet wired up to actively process customer data as of this writing. We will update this page before any of them begin processing customer data.
Changes to this list
We will update this page when we add or remove a sub-processor. Material changes affecting the processing of Client Personal Data under our Data Processing Addendum will be communicated to affected customers.