Legal · Document
Subprocessors
Galan uses third parties (“subprocessors”) to process personal information on its behalf. Each subprocesser is contractually bound to process personal information only on our documented instructions and to provide a level of protection at least equivalent to our Privacy Policy.
Last updated: 2026-07-27. To subscribe to changes (subprocessor additions, removals, or material changes to processing), email privacy@galan.com with subject line “Subscribe to subprocessor updates”.
Current subprocessers
| Service | Purpose | Data processed | Location | Privacy policy |
|---|---|---|---|---|
| Neon | Serverless Postgres database hosting | All tenant database rows (customer data, financial records, journal entries, vendor data, invoice lines, audit logs). | United States | neon.tech/privacy-policy |
| Vercel | Cloud application hosting, edge runtime, serverless function execution | Application logs, request IP addresses, browser user-agent strings, route metadata, response payloads (transient — not retained). | United States | vercel.com/legal/privacy-policy |
We will provide at least 30 days’ notice before adding a new subprocesser or changing the data categories processed by an existing subprocesser. Notice will be sent to the subscription-requesting email address above and updated on this page.
Planned sub-processors (Phase 2 — not yet engaged)
The following processors are not yet engaged. They will be added to the list above with 30 days’ notice when engagement begins. Publishing them here now is for transparency: customers can evaluate the future sub-processor chain before Phase 2 ships.
| Service | Purpose | Data processed | Tentative location |
|---|---|---|---|
| StripePhase 2 | Card and ACH payment processing; Stripe Tax | Card and ACH transaction records, customer billing details, charge metadata. | United States |
| Avalara AvaTaxPhase 2 | US sales-tax computation (tenant-chosen, see D1 decision memo) | Billing addresses, line-item descriptions, transaction dates. | United States / global |
| Stripe TaxPhase 2 | US sales-tax computation (alternative provider, tenant-chosen) | Same as Avalara. | United States |
| TaxJarPhase 2 | US sales-tax computation (alternative provider, tenant-chosen) | Same as Avalara. | United States |
| ResendPhase 2 | Transactional email (password resets, invoices, system notifications) | Recipient email addresses, message content, delivery metadata. | United States |
| PlaidPhase 2 | US/CA bank-feed linking and transaction sync | Opaque bank-account tokens, transaction records, balance snapshots. | United States |
| GoCardlessPhase 2 | EU/UK bank-feed linking (existing integration) | Same as Plaid, scoped to EU/UK tenants. | European Union / United Kingdom |
Per-tenant providers (not sub-processors of Galan)
The above list covers providers that process data on Galan’sdirect behalf. Tenants may independently engage their own service providers (e.g., a tax accountant viewing tenant data, a fulfilment warehouse receiving shipment events). Those providers are not Galan’s subprocessers; they are governed by the tenant’s own vendor agreements and privacy practices.
Document changelog
- 2026-07-27 (v0.1 draft). Initial authored version. Subprocessor list frozen to Neon and Vercel per Phase 1 launch scope; Phase 2 sales-tax and payment providers listed under “planned” for transparency prior to onboarding.