Epickod, operator of EpicIMS · Version 2026-09-30
Subprocessors and international transfers
This page identifies the service-provider categories used by EpicIMS and the safeguards that must be confirmed for the deployed environment. It is the public change-notice location for subprocessors.
Effective date: 30 September 2026. Last reviewed: 30 September 2026.
Current processing chain
| Provider/category | Purpose | Data | Transfer safeguard |
|---|---|---|---|
| Google Firebase Authentication | Identity and sign-in | Name, email, authentication identifiers | DPA and applicable adequacy/SCC assessment |
| Epicod hosting, database and object storage | Application, records, receipts and backups | All customer workspace data | Hosting region, encryption and access controls must match the executed DPA |
| Resend or configured mail provider | Transactional invoice and account email | Recipient address, sender, subject, message and attachment | Provider DPA and transfer mechanism |
| Configured Penny AI provider | Optional assistant response and tool reasoning | Prompt and selected finance context | Customer opt-in/configuration, provider DPA, no-training/retention terms and transfer assessment |
International transfer rules
For EEA data transferred to a non-EEA provider, the parties must document an adequacy decision, EU Standard Contractual Clauses or another valid GDPR Chapter V safeguard. The executed DPA must identify the SCC module, annexes, transfer impact assessment and supplementary measures where required. UK transfers require the applicable UK mechanism or addendum.
Customers may request current vendor contract and transfer information from privacy@epickod.org.
Changes and objections
We will publish a change here before a new subprocesser processes customer data, except where an urgent security replacement is necessary. Customers may object on reasonable data-protection grounds within the period stated in their DPA. If the objection cannot be resolved, the parties will follow the DPA termination or alternative-processing process.
Customer configuration requirement
- Confirm the actual hosting, database, backup and storage regions before launch.
- Confirm the exact Firebase, mail and AI products and their current DPAs.
- Do not enable Penny for a customer until the customer has accepted the relevant disclosure and processor terms.