Sub-Processor List
Last updated: March 2026
Second Difference Solutions®, LLC ("we," "us," or "our") uses the following third-party sub-processors in the delivery of the BizAnalyzer platform and related services. A sub-processor is any third party that processes personal data on our behalf as part of providing our services to you.
This list is maintained in accordance with GDPR Article 28 and our Data Processing Addendum. We notify customers of material changes to this list at least 30 days before the change takes effect.
Infrastructure and Hosting
Google Cloud Platform (Firebase)
Purpose: Cloud infrastructure, Firestore database, Firebase Authentication, Cloud Functions hosting, and Cloud Run compute.
Data location: United States (us-central1 region)
Data processed: All application data including user accounts, financial data caches, OAuth tokens, and API logs.
Transfer mechanism: EU-US Data Privacy Framework; Standard Contractual Clauses available upon request.
Website: https://cloud.google.com
Payment Processing
Stripe, Inc.
Purpose: Subscription billing, payment processing, and invoice management.
Data location: United States
Data processed: Payment method details (tokenized), billing address, subscription history, transaction records.
Transfer mechanism: EU-US Data Privacy Framework; Standard Contractual Clauses available upon request.
Website: https://stripe.com
AI Analysis Features
The following providers process summarized financial data (report-level totals, calculated ratios, account category totals) when you use AI chat features in BizAnalyzer. Individual transactions, vendor names, customer names, bank account numbers, and personally identifying information are not sent to these providers. All AI providers are contractually prohibited from using your data for model training.
OpenAI, L.L.C.
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Financial summary context (totals, ratios, percentages) and your natural language queries.
Transfer mechanism: Standard Contractual Clauses; no-training pledge for API data.
Website: https://openai.com
Anthropic, PBC
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Financial summary context (totals, ratios, percentages) and your natural language queries.
Transfer mechanism: Standard Contractual Clauses; no-training pledge for API data.
Website: https://anthropic.com
Google LLC (Gemini, via Vertex AI)
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Financial summary context (totals, ratios, percentages) and your natural language queries.
Transfer mechanism: EU-US Data Privacy Framework; no-training pledge for API data.
Website: https://cloud.google.com/vertex-ai
QuickBooks Data Source
Intuit, Inc. (QuickBooks Online API)
Purpose: Source of financial data for BizAnalyzer via your OAuth-authorized connection. We retrieve read-only financial reports on your behalf.
Data location: United States
Data processed: OAuth access tokens (stored encrypted); we retrieve financial report data from your QuickBooks account during active sessions and refresh cached report data according to cache freshness rules (paid QBO tier).
Transfer mechanism: EU-US Data Privacy Framework.
Note: Intuit is the original controller of your QuickBooks data. Our access is governed by your authorization and is read-only. We never modify, delete, or create transactions in QuickBooks.
Website: https://developer.intuit.com
Analytics
Google LLC (Google Analytics)
Purpose: Aggregate usage analytics for site performance and feature improvement. We do not share your financial data with Google Analytics.
Data location: United States
Data processed: Anonymized page views, session data, browser type, referral source. Financial data is never included.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://analytics.google.com
Data Processing Addendum
If you require a Data Processing Addendum (DPA) for compliance purposes, one is available upon request. Email info@2diff.io with the subject line Data Processing Addendum Request.
Questions
For questions about this sub-processor list or our data handling practices, contact us at info@2diff.io or review our Privacy Policy.