Sub-processors
To deliver To Bill, we entrust some processing of personal data to providers. They act on our instructions and only for the purposes stated below (art. 9 FADP).
Last updated: 12 October 2026
To Bill application (app.tobill.ch, mobile app, fiduciary cockpit)
Infomaniak Network SA
- Role
- Hosting of the application servers, the database and its backups.
- Data
- All the data of your account and your company.
- Location
- Infomaniak Network SA, Geneva; data centres in Switzerland; data processing agreement included in its general terms
Exoscale
- Role
- File storage: logos, receipts, PDFs of invoices and quotes, Drive files.
- Data
- Files you upload or To Bill generates.
- Location
- Akenes SA (Exoscale), Lausanne; Geneva data centre (zone ch-gva-2), Switzerland
Anthropic PBC
- Role
- Artificial intelligence (Claude models): reading documents and imports, proposals, the Copilot (questions about your figures, draft quotes and invoices). On by default, it is switched off in Settings › AI (see section 5 of the privacy policy).
- Data
- Data the feature in use needs: figures of your books without IBANs, AHV/AVS numbers, e-mails, phone numbers or people's names, or the file, import rows or address you hand it, as they are. Payroll data only if you allow it: the totals of each payroll run for the Copilot, the facts of a work certificate without name or salary.
- Location
- Anthropic Ireland, Limited (Ireland), the contracting party for Switzerland; processing by Anthropic PBC in the United States; standard contractual clauses with the Swiss addendum, in the data processing agreement included in its commercial terms
Resend
- Role
- E-mail delivery: invoices, quotes and reminders to your customers (unless you use your own SMTP server), invitations, password resets, notifications.
- Data
- Recipient's name and address, content of the e-mail, attached PDFs.
- Location
- Plus Five Five, Inc. (Resend), United States: data stored in the United States, sending from Ireland (AWS eu-west-1); standard contractual clauses under the FADP, in its data processing agreement concluded at sign-up
Stripe
- Role
- Subscription payments; online payment of invoices by your customers if you connect your Stripe account.
- Data
- Name, e-mail, amount and payment data. To Bill stores no card data.
- Location
- Stripe Payments Europe, Limited (Ireland); transfers to Stripe, LLC (United States), which declares participation in the DPF (Swiss part), and Stripe's Data Transfer Addendum
Pingen
- Role
- Postal delivery of invoices, when you choose to send them by mail.
- Data
- PDF of the invoice, recipient's name and address.
- Location
- Pingen GmbH, Zurich; data hosted at cloudscale, in Switzerland
Sentry
- Role
- Error reports of the web and mobile app; on an error, a recording of the screen with its text and images masked.
- Data
- Type of error, browser or device, page viewed.
- Location
- Functional Software, Inc. (Sentry), United States; data hosted in the European Union (Frankfurt, Germany); DPF declared (Swiss part)
Mezmo
- Role
- Collection of the servers' technical logs.
- Data
- Technical logs, including IP addresses.
- Location
- Mezmo, Inc., United States (hosted on AWS in the United States); DPF declared (Swiss part); Mezmo's DPA applies
- Role
- Sign in with Google; address suggestions (Google Maps) while typing; checking subscriptions bought on Google Play.
- Data
- Name and e-mail of the Google account; address being typed; purchase receipt.
- Location
- Google Ireland Limited (Ireland) and Google LLC (United States), which declares participation in the DPF (Swiss part)
Apple
- Role
- Sign in with Apple; checking subscriptions bought on the App Store.
- Data
- Apple account identifier and e-mail; purchase receipt.
- Location
- Apple Distribution International Ltd. (Ireland) and Apple Inc. (United States); standard contractual clauses
Expo (650 Industries)
- Role
- Sending the mobile app's notifications, then delivered by Apple or Google.
- Data
- Device identifier and text of the notification, for example the customer's name, the number and amount of a paid invoice.
- Location
- 650 Industries, Inc. (Expo), United States; hosted on Google Cloud; DPF declared (Swiss part) and standard contractual clauses in its terms
Brevo
- Role
- Information e-mails about your account (trial, subscription, getting started).
- Data
- Name, e-mail, language, plan and subscription status, company name and canton, number of invoices, last activity.
- Location
- Sendinblue SAS (Brevo), Paris, France; data hosted in the European Union; DPA included in Brevo's terms
Slack
- Role
- Internal alerts for the To Bill team (new company, trial, subscription, outage).
- Data
- Company and user numbers, amounts, plans; never a name, an e-mail or a card number.
- Location
- Slack Technologies, LLC, United States; DPF declared (Swiss part, through Salesforce)
tobill.ch website
Vercel
- Role
- Hosting of the website.
- Data
- IP address, request headers, form content in transit.
- Location
- Vercel Inc., United States; worldwide delivery network (Frankfurt for Switzerland), forms handled in Frankfurt (Germany, region fra1); automatic DPA with standard contractual clauses, DPF declared (Swiss part)
Google (Analytics)
- Role
- Audience measurement (GA4), only with your consent to analytics cookies.
- Data
- IP address, pages viewed, device, cookie identifiers.
- Location
- Google LLC, United States; DPF declared (Swiss part); Google Ads Data Processing Terms, which apply automatically to a business established in Switzerland
PostHog
- Role
- Audience measurement and session recording, only with your consent to analytics cookies.
- Data
- Pages viewed, clicks, course of the visit, cookie identifiers, IP address.
- Location
- PostHog, Inc.; European instance, Frankfurt (Germany); DPF declared (Swiss part)
Meta
- Role
- Measuring advertising campaigns (Meta pixel), only with your consent to marketing cookies.
- Data
- IP address, pages viewed, events, cookie identifiers.
- Location
- Meta Platforms Ireland Limited (Ireland), the contracting party for Switzerland; Data Processing Terms included in Meta's Business Tools Terms; transfer to Meta Platforms, Inc. (United States), DPF declared (Swiss part)
Resend
- Role
- Contact forms and newsletter sign-up.
- Data
- Name, e-mail, company, message.
- Location
- Plus Five Five, Inc., United States (storage); sending from Ireland (AWS eu-west-1); DPA pre-signed by Resend and concluded at sign-up, standard contractual clauses
Technical provider (AI search engine crawlers)
- Role
- Serves the crawlers of AI search engines an adapted version of the site and counts their visits; no data of human visitors is passed to it.
- Data
- Only for requests that announce themselves as an AI crawler: crawler name, page, user agent and IP address of the request. No cookie, no data of a human visitor.
Other recipient
Commercial register (Zefix, Federal Office of Justice): when you look up your company while registering it in To Bill, the name you type is sent to Zefix to retrieve its official data.
Disclosure abroad
The States of the European Union offer an adequate level of protection recognised by the Federal Council (art. 16 para. 1 FADP, annex 1 of the Data Protection Ordinance). For the United States, this level is recognised only for companies certified under the Swiss-U.S. Data Privacy Framework; otherwise, the disclosure relies on contractual safeguards, in particular the standard contractual clauses recognised by the FDPIC (art. 16 para. 2 let. d FADP).
Participation in the Swiss-U.S. Data Privacy Framework is declared by Google LLC, Stripe, LLC, Meta Platforms, Inc., Vercel, PostHog, Sentry, Expo, Slack (through Salesforce) and Mezmo. The data processing agreements of Anthropic, Resend and Apple provide for the European Commission's standard contractual clauses, adapted to Swiss law; several other providers provide for them in addition.
Changes
We update this list before adding or replacing a sub-processor. To Bill's general terms provide that we inform you beforehand and that you may object (art. 9 para. 3 FADP, art. 7 DPO). Questions: info@tobill.ch.