Sub-Processor List
Last updated: November 2026
Second Difference Solutions®, LLC ("we," "us," or "our") uses the following third-party sub-processors in the delivery of the 2diff Business platform and related services. A sub-processor is any third party that processes personal data on our behalf as part of providing our services to you.
This list is maintained in accordance with GDPR Article 28 and our Data Processing Addendum. We notify customers of material changes to this list at least 30 days before the change takes effect.
Infrastructure and Hosting
Google Cloud Platform (Firebase)
Purpose: Cloud infrastructure, Firestore database, Firebase Authentication, Cloud Functions hosting, and Cloud Run compute.
Data location: United States (us-central1 region)
Data processed: All application data including user accounts, financial data caches, OAuth tokens, and API logs.
Transfer mechanism: EU-US Data Privacy Framework; Standard Contractual Clauses available upon request.
Website: https://cloud.google.com
Payment Processing
Stripe, Inc.
Purpose: Subscription billing, payment processing, and invoice management.
Data location: United States
Data processed: A customer record created when you create an account, even if you never subscribe (your email address and account ID); the name, phone number, and billing address you enter at checkout; payment method details (tokenized); subscription history; transaction records.
Transfer mechanism: EU-US Data Privacy Framework; Standard Contractual Clauses available upon request.
Website: https://stripe.com
AI Analysis Features
The following providers process summarized financial data (report-level totals, calculated ratios, account category totals) when you use AI chat features in 2diff Business, on the plans that include them: the Free plan, on sample business figures only; the Silver plan; and the former Pro plan. Individual transactions, vendor names, customer names, bank account numbers, and personally identifying information are not sent to these providers. Each provider handles your request under its own published API terms, which state that API content is not used to train their models; we link to those terms from our Privacy Policy and do not control them.
On a paid plan, those summarized figures can come from either of two sources, and both are covered by this section:
- A connected QuickBooks® Online account (2diff Business Silver, and the former Pro plan). The summarized totals are derived from the reports we retrieve on your behalf. See the QuickBooks Online data source entry below.
- Figures you type in yourself (2diff Business Silver, when you work from figures you type in). The summary figures you enter, and the ratios calculated from them, are what would be sent to the AI providers above if you use AI insights. Nothing is retrieved from Intuit or any other outside service for those figures.
2diff Business Bronze connects to no accounting software, bank, or other outside service, and it has no AI features, so no figures from a 2diff Business Bronze account are sent to these providers. Nothing is retrieved from Intuit or any other outside service for a 2diff Business Bronze account.
AI insights are optional in every case. If you do not use them, no financial figures are sent to any AI provider.
The same providers also run the optional AI features in these apps, where you have access to them. Each sends your question plus:
- 2diff Marketing: reporting figures from the Google accounts you connect, including campaign names, keywords, search terms, ad headlines, the search queries your site appeared for, page paths, and traffic sources. Property IDs, site URLs, and customer IDs are withheld.
- BizFeasibility: the results our model computes from the project inputs you enter (scenario metrics, flags, key drivers, scenario comparisons, and assumptions).
- ParcelAnalyzer: aggregate figures about your parcel dataset (counts, shares, ranges, and category labels). Owner names, addresses, and parcel IDs are not sent.
- FilmAnalyzer: the parts of your film project you select, such as chapters, characters, summary, notes, and research.
OpenAI, L.L.C.
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Summary context for the feature you use (for 2diff Business: totals, ratios, and percentages) and your natural language queries.
Transfer mechanism: Standard Contractual Clauses; no-training pledge for API data.
Website: https://openai.com
Anthropic, PBC
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Summary context for the feature you use (for 2diff Business: totals, ratios, and percentages) and your natural language queries.
Transfer mechanism: Standard Contractual Clauses; no-training pledge for API data.
Website: https://anthropic.com
Google LLC (Gemini, via Vertex AI)
Purpose: AI-powered financial analysis and natural language query responses.
Data location: United States
Data processed: Summary context for the feature you use (for 2diff Business: totals, ratios, and percentages) and your natural language queries.
Transfer mechanism: EU-US Data Privacy Framework; no-training pledge for API data.
Website: https://cloud.google.com/vertex-ai
Identity and Authentication
Intuit, Inc. (Sign in with Intuit)
Purpose: Identity verification and "Sign in with Intuit" OAuth 2.0 / OpenID Connect authentication, allowing you to sign in to 2diff Business with your Intuit account. This is distinct from the QuickBooks Online API entry below, which covers financial data retrieval.
Data location: United States
Data processed: Intuit account identifier, verified email address, and the tokens issued during sign-in. We use these only to recognize your account on later sign-ins; see the Privacy Policy note on Sign-In Identity for retention and removal.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://developer.intuit.com
Google LLC (Sign in with Google)
Purpose: Lets you sign in with your Google account through Firebase Authentication. This is distinct from the Google marketing data source entry below, which covers the reporting data 2diff Marketing reads.
Data location: United States
Data processed: Your Google account name, email address, and profile photo URL, which Firebase Authentication receives when you sign in with Google. We keep your name and email address on your account profile.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://firebase.google.com
QuickBooks® Online (data source)
Intuit, Inc. (QuickBooks® Online API)
Purpose: Source of financial data for 2diff Business via your OAuth-authorized connection. We only retrieve financial reports on your behalf; we never write to your QuickBooks account.
Data location: United States
Data processed: OAuth access tokens (stored encrypted); we retrieve financial report data from your QuickBooks account during active sessions and refresh cached report data according to cache freshness rules (2diff Business Silver and the former Pro plan).
Transfer mechanism: EU-US Data Privacy Framework.
Note: Intuit is the original controller of your QuickBooks data. Our access is governed by your authorization. We never modify, delete, or create transactions in QuickBooks.
Website: https://developer.intuit.com
Google marketing data (data source)
Google LLC (Google Analytics Data, Search Console, and Google Ads APIs)
Purpose: 2diff Marketing reports on the Google Analytics, Search Console, and Google Ads accounts you connect. We only read your reporting data, and we never create, change, or delete anything in your Google accounts.
Data location: United States
Data processed: OAuth tokens (stored encrypted) and the email address of the Google account you connect; aggregated report metrics, fetched when you open a report; and a monthly summary history of up to 36 months of totals for each workspace, kept until the workspace is deleted.
Transfer mechanism: EU-US Data Privacy Framework.
Note: Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. See the Privacy Policy's 2diff Marketing section for retention and disconnection.
Website: https://developers.google.com
Analytics
Google LLC (Google Analytics)
Purpose: Aggregate usage analytics for site performance and feature improvement. We do not share your financial data with Google Analytics.
Data location: United States
Data processed: Anonymized page views, session data, browser type, referral source. Financial data is never included.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://analytics.google.com
Google LLC (Google Ads conversion tracking)
Purpose: Measures whether a visit that arrived from one of our ads went on to sign up or subscribe, so we can tell which campaigns work. We do not share your financial data with Google Ads, and we do not use it to retarget you on other websites.
Data location: United States
Data processed: Ad click identifiers and first-party conversion cookies, page views, and the fact that a signup or subscription occurred. A first-party cookie set on the landing page, with your consent, ties the signup or subscription back to the ad click. Financial data is never included.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://ads.google.com
Scheduling
When you book a call through a link on our site, the booking provider below receives what you enter on its booking page.
Google LLC (Google Calendar appointment schedules)
Purpose: Books the calls you schedule through our booking links.
Data location: United States
Data processed: The name, email address, and any answers you enter on the booking page.
Transfer mechanism: EU-US Data Privacy Framework.
Website: https://calendar.google.com
Calendly LLC
Purpose: Books the calls you schedule through the meeting links on some of our pages.
Data location: United States
Data processed: The name, email address, and any answers you enter on the booking page.
Transfer mechanism: Calendly's own privacy policy and data processing terms apply.
Website: https://calendly.com
Email delivery
When you submit one of our forms or sign up for updates, we send email through the provider below. Transactional messages (such as a form acknowledgement or the newsletter confirmation link) go to the address you gave us. If you confirm a newsletter signup, your address is stored as a contact so we can send you updates until you unsubscribe. No financial data is sent through this provider.
Resend (Plus Five Five, Inc.)
Purpose: Transactional email delivery (form acknowledgements and the newsletter confirmation email) and storage of confirmed newsletter contacts. We do not send your financial data through Resend.
Data location: United States
Data processed: Recipient email address, the display name you provide, and the subject and body of the message we send. For a confirmed newsletter signup, your email address and name are stored as a contact so we can send you updates until you unsubscribe.
Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework.
Website: https://resend.com
Data Processing Addendum
If you require a Data Processing Addendum (DPA) for compliance purposes, one is available upon request. Email info@2diff.io with the subject line Data Processing Addendum Request.
Questions
For questions about this sub-processor list or our data handling practices, contact us at info@2diff.io or review our Privacy Policy.