Source: https://billingmart.com/subprocessors [Legal](https://billingmart.com/legal) Subprocessors # Subprocessors This directory details the authorized third-party infrastructure providers, payment gateways, mobile application distribution services, and communication platforms engaged by BillingMart to deliver our multi-tenant invoicing services. Last revised: October 2026 • Version: 1.0 ## Contents 1. Platform Scope and Data Architecture2. Authorized Subprocessors Directory3. Mobile Distribution and Device Push Infrastructure4. Vendor Due Diligence and Security Standards5. Notification and Objection Rights6. General Terms7. Disclaimers, Limitation of Liability and Indemnification [← All legal agreements](https://billingmart.com/legal) ## 1. Platform Scope and Data Architecture BillingMart (operated by BillingMart.com LLC) provides multi-tenant billing, invoicing, payment reconciliation, and client management software. Under applicable data protection legislation—including the EU General Data Protection Regulation (GDPR), UK GDPR, and California Consumer Privacy Act (CCPA/CPRA)—BillingMart acts as a Data Processor on behalf of our customers (the Data Controllers). To provide a scalable, secure, and resilient platform, BillingMart engages a limited group of specialized third-party subprocessors. Each subprocessor is selected through rigorous technical and compliance reviews, bound by written data processing agreements, and constrained by platform-level data minimization and cryptographic boundaries. ## 2. Authorized Subprocessors Directory The following table identifies the external service providers authorized to process customer data in connection with the BillingMart platform: ### Google Cloud Platform (Firebase) Google LLC • Mountain View, California, USA Cloud Hosting & Core Database Service Role Primary cloud hosting, multi-tenant database (Cloud Firestore), encrypted storage, serverless compute (Cloud Functions 2nd Gen), and identity services. Data Handled & Platform Boundaries All stored platform records including business profiles, client records, invoice items, estimates, accounting ledger records, user credentials, immutable audit logs, and minimized payment link page view records (a shortened network address, approximate country and region where supplied with the request, and device type). Safeguard: EU Standard Contractual Clauses (SCCs), ISO 27001, SOC 2 Type II, AES-256 encryption at rest. ### TranzPay TranzPay LLC • Alpharetta, Georgia, USA Payment Gateway & Tokenization Vault Service Role Credit card processing, ACH bank debit routing, and tokenized payment vaulting. Data Handled & Platform Boundaries Cardholder data (full card number, security code, expiration date) and bank routing/account numbers submitted on pay links. BillingMart stores only tokenized vault references and card metadata (last 4 digits, card brand); full card data exists ephemerally in charging functions and is never stored on BillingMart servers. Safeguard: PCI DSS Level 1 Service Provider, per the provider’s own attestation; encrypted gateway connections (TLS). ### Apple Inc. Apple Inc. / Apple Distribution International Ltd. • Cupertino, California, USA / Cork, Ireland Mobile Application Distribution & Push Infrastructure Service Role Distribution of the BillingMart iOS client application via the Apple App Store, native operating system application sandboxing, and device-level push notification routing via Apple Push Notification service (APNs). Data Handled & Platform Boundaries Cryptographic device tokens for mobile alert routing (e.g. invoice paid alerts) and application binary delivery telemetry. Apple does not receive or store workspace financial ledgers, customer accounting records, or payment card numbers. Safeguard: Apple DPA, EU Standard Contractual Clauses (SCCs), application-level cryptographic tokens, zero local financial data retention. ### Google LLC (Google Play & FCM) Google LLC • Mountain View, California, USA Mobile Application Distribution & Push Infrastructure Service Role Distribution of the BillingMart Android client application via Google Play Store, native operating system sandboxing, and device-level notification dispatch via Firebase Cloud Messaging (FCM). Data Handled & Platform Boundaries Cryptographic device push tokens and application download/update delivery telemetry. Google Play services do not receive or store tenant invoice records, customer accounting books, or cardholder numbers. Safeguard: Google Cloud DPA, EU Standard Contractual Clauses (SCCs), ephemeral push payloads containing no cardholder or sensitive personal data. ### Google Maps Platform (Places API) Google LLC • Mountain View, California, USA Address Suggestions Service Role Suggests full street addresses as a signed-in workspace member types one in the merchant application and rate request, and returns the chosen address’s parts. Data Handled & Platform Boundaries The partial street address being typed and the chosen place identifier, sent from the member’s browser. No invoice records, client records, identity documents or cardholder data. Safeguard: Google Maps Platform Terms and Data Processing Terms, EU Standard Contractual Clauses (SCCs). ### Resend Resend Inc. • San Francisco, California, USA Transactional Communications Service Role High-reliability transactional email infrastructure for sending customer invoices, payment links, receipts, and account notices. Data Handled & Platform Boundaries Recipient customer email addresses, sender business names, email subjects, and PDF invoice documents attached to messages. Unrelated workspace accounting data is excluded from email dispatches. Safeguard: Data Processing Addendum, EU Standard Contractual Clauses (SCCs), TLS 1.3 transmission encryption. ### Twilio Twilio Inc. • San Francisco, California, USA Transactional Communications & Verification Service Role SMS message delivery for invoice payment links and two-factor authentication (2FA) verification. Data Handled & Platform Boundaries Verified customer telephone numbers, one-time authentication codes, and outbound payment alert texts. Consent tracking and STOP requests are isolated per business. Safeguard: Twilio Binding Corporate Rules (BCRs), EU Standard Contractual Clauses (SCCs), SOC 2 Type II. ### Google (Gemini API and Vertex AI) Google LLC • Mountain View, California, USA AI Assistant & Generative Models Service Role Server-side generative language model assistance for drafting invoice line descriptions, template styling, schema extraction and the built-in Agent. Requests are answered by Google's Gemini API or by Vertex AI in BillingMart's own Google Cloud project; if the one in use is overloaded, the same request may be sent once to the other. Data Handled & Platform Boundaries Ephemeral text prompts submitted during user-initiated AI drafts. Runs strictly server-side within Cloud Functions; requests are processed ephemerally and discarded upon JSON validation. BillingMart customer records and financial books are never used to train third-party foundation models. Safeguard: Google's Gemini API terms for paid services and Google Cloud's terms for Vertex AI, with no use of customer data to train models; EU Standard Contractual Clauses (SCCs). ## 3. Mobile Distribution and Device Push Infrastructure BillingMart offers native mobile client applications for Apple iOS and Google Android operating systems to provide on-the-go invoicing, estimate approvals, and instant payment notifications. To distribute these applications and deliver real-time operational alerts, BillingMart engages **Apple Inc.** and **Google LLC** under strictly defined architectural controls: - **Application Sandboxing:** Native binaries distributed through the Apple App Store and Google Play Store execute within the host operating system’s isolated application sandbox. Local device storage is restricted to cached session tokens and active workspace views. - **Zero Card Data Retention on Mobile:** Cardholder numbers and bank account credentials are never cached, stored, or processed by mobile application runtime storage. - **Operational-Only Push Notifications:** Device push tokens generated by Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) are stored alongside authenticated user session records. Push payloads contain only generic operational event identifiers (e.g. "Invoice 1042 Paid") and exclude sensitive financial ledger details, customer addresses, or payment card metadata. ## 4. Vendor Due Diligence and Security Standards Before onboarding a third-party subprocessor, BillingMart reviews, among other things: - **Published assurances:** the provider's own published security documentation and certifications (for example SOC 2, ISO/IEC 27001 or PCI DSS, where the provider holds them). BillingMart does not audit or certify its providers. - **Contractual Commitments:** Execution of Data Processing Addenda (DPAs) mandating strict confidentiality, breach notification within 48 hours, and data processing limited exclusively to documented platform instructions. - **International Data Transfers:** Where customer data is processed outside the European Economic Area (EEA), United Kingdom, or Switzerland, BillingMart implements valid transfer mechanisms, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the EU-U.S. Data Privacy Framework. - **Principle of Least Privilege:** Access to subprocessor environments is restricted to automated service accounts and scoped API credentials managed by Cloud Secret Manager. No direct human access to production databases is granted to third parties. ## 5. Notification and Objection Rights BillingMart maintains an up-to-date record of all authorized subprocessors on this page. When BillingMart intends to engage any new subprocessor or replace an existing provider: 1. BillingMart will give notice of a new or replacing subprocessor by updating this page before the change takes effect. 2. A customer workspace owner may object on documented data protection grounds within 30 days of that update, by written notice to [privacy@billingmart.com](mailto:privacy@billingmart.com) . 3. If BillingMart cannot reasonably accommodate the objection or offer an alternative configuration, the customer may terminate their subscription without penalty and request complete data export prior to termination. ## 6. General Terms - **The Terms of Service control.** This page forms part of, and is governed by, the [Terms of Service](https://billingmart.com/terms) , the [Privacy Policy](https://billingmart.com/privacy) and the [Acceptable Use Policy](https://billingmart.com/aup) . If this page and the Terms of Service conflict, the Terms of Service control. - **No additional obligations.** This page describes how BillingMart.com LLC ("BillingMart", "we", "us") operates. It does not create a contract, a warranty, a guarantee or any obligation beyond those in the Terms of Service and those that applicable law imposes, and nothing on it waives a right, defense, privilege or exemption available to BillingMart under the Terms of Service or the law. - **Disclaimers and limits apply.** The warranty disclaimers, limitation of liability, governing law (New Mexico) and binding arbitration provisions of the Terms of Service apply to everything described here, to the fullest extent the law allows. - **No third-party beneficiaries.** This page confers no rights or remedies on any person other than as applicable law requires. - **Changes.** We may update this page at any time by posting a new version here; the "Last revised" date shows when it last changed. A change applies from when it is posted unless the law requires otherwise. Continued use of BillingMart after a change means you accept it. - **Severability.** If any part of this page is found unenforceable, the rest remains in effect, and the unenforceable part is limited to the minimum extent necessary. - **Questions.** Use our [Contact page](https://billingmart.com/contact) . For a privacy request, use the [Data Removal Request](https://billingmart.com/privacy-request) page. ## 7. Disclaimers, Limitation of Liability and Indemnification This section restates, and this page incorporates by reference, Sections 10 (Warranties and Disclaimers), 11 (Limitation of Liability) and 11A (Indemnification) of the [Terms of Service](https://billingmart.com/terms#disclaimers) . They apply to everything this page describes, to the fullest extent the law allows, and the Terms of Service control if the two differ. Where applicable law does not permit a disclaimer, limitation or exclusion below, it applies to the extent the law permits. THE PLATFORM, CONSOLE, REST APIS, PAY PAGES AND EVERY SERVICE, FEATURE, PAGE, NOTICE AND PROCESS DESCRIBED HERE ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, BILLINGMART.COM LLC AND ITS AFFILIATES EXPRESSLY DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE. IN NO EVENT SHALL BILLINGMART, ITS OFFICERS, DIRECTORS, MEMBERS, MANAGERS, EMPLOYEES, AGENTS OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF REVENUE, PROFIT, GOODWILL, OR TRANSACTIONAL DATA, ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE PLATFORM OR ANYTHING DESCRIBED ON THIS PAGE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER THE TERMS OF SERVICE OR THIS PAGE SHALL BE STRICTLY LIMITED TO THE TOTAL FEES PAID BY YOU TO BILLINGMART IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, WHICH MAY BE ZERO. **Indemnification.** The indemnity in [Section 11A of the Terms of Service](https://billingmart.com/terms#indemnification) — your defense and indemnification of the BillingMart Parties against claims arising from your use of the Services, the content you send, your dealings with your customers and the consents and notices the law requires of you — applies to the activities this page describes as if set out here in full. Nothing on this page creates a warranty, a service level, a guarantee or a duty of care beyond those stated in the Terms of Service, and every exemption, safe harbor, limitation and defense available to BillingMart under applicable law is preserved. ### Legal and compliance questions If you have questions regarding this agreement, or need a countersigned copy of our Data Processing Addendum, contact us at [legal@billingmart.com](mailto:legal@billingmart.com) or write to our privacy officer at [privacy@billingmart.com](mailto:privacy@billingmart.com) . ## Related legal documents [Terms of Service Read document →](https://billingmart.com/terms) [Privacy Policy Read document →](https://billingmart.com/privacy) [Data Processing Addendum Read document →](https://billingmart.com/dpa) [Acceptable Use Policy Read document →](https://billingmart.com/aup) [Service Level Agreement Read document →](https://billingmart.com/sla) [Cookie Policy Read document →](https://billingmart.com/cookies) [E-Sign Consent Read document →](https://billingmart.com/e-sign) [Accessibility Statement Read document →](https://billingmart.com/accessibility) [Text Message Terms Read document →](https://billingmart.com/sms-terms) [US State Privacy Rights Read document →](https://billingmart.com/privacy/states) [Data Removal Request Read document →](https://billingmart.com/privacy-request) [Partner Program Agreement Read document →](https://billingmart.com/legal/partner-agreement) --- This is the Markdown copy of https://billingmart.com/subprocessors. Live plans, prices and limits are published as JSON at https://billingmart.com/plans.json and https://billingmart.com/agent-info.json.