Sub-processors
Last updated: 29 October 2026
This is the current list of the sub-processors that Invenza engages for the processing of personal data, with the legal entity, the location and the transfer mechanism.
Notice of new sub-processors
We announce a new sub-processor by updating this list and by e-mailing each accounting firm at the address known in the platform, at least 30 days before the new sub-processor starts processing personal data. The accounting firm can object within 30 days after that notice, by e-mail to privacy@invenza.be.
List of sub-processors
| Sub-processor | Legal entity | Purpose | Which data | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Microsoft Azure (App Service, SQL Database, Blob Storage) | Microsoft Ireland Operations Ltd | Hosting, database and document storage | All application data | Belgium Central (Belgium, EU) | Not applicable: processing within the EEA |
| Microsoft Application Insights | Microsoft Ireland Operations Ltd | Error and performance monitoring | IP address, user ID and role of logged-in users, pages visited, error messages | Germany West Central (Germany, EU) | Not applicable: processing within the EEA |
| Maventa (Visma) | Inexchange Oy | Electronic invoicing over the Peppol network | Invoice content and identification of sender and recipient | Finland (EU) | Not applicable: processing within the EEA |
| Mailgun | Mailgun Technologies, Inc. | Receiving e-mails for the e-mail import | E-mails and attachments sent to your import address | EU region (Germany, Belgium) | Hosting in the EU region; for support access from outside the EEA, Sinch relies on the EU-US Data Privacy Framework and Standard Contractual Clauses (Sinch DPA, clause 12(d)) |
| Combell NV | Combell NV | Sending invitations, password resets, invoices and reminders | Recipient e-mail address and the content of the e-mail | Belgium (EU) | Not applicable: processing within the EEA |
| Hetzner | Hetzner Online GmbH | Storage of accounting export files on an SFTP server until the accounting software collects them | Content of the export files (invoices as PDF and structured file): names, addresses and contact data, IBAN and payment data, invoice lines, VAT and enterprise numbers | Germany (EU) | Not applicable: processing within the EEA |
| Microsoft Azure OpenAI | Microsoft Ireland Operations Ltd | AI assistant and document understanding | Conversation content, document text, customer names appearing in your question | EU region | Not applicable: processing within the EEA |
| Microsoft Azure AI Document Intelligence | Microsoft Ireland Operations Ltd | Text recognition (OCR) of uploaded invoices and receipts | Uploaded documents | EU region | Not applicable: processing within the EEA |
| Microsoft Azure AI Speech | Microsoft Ireland Operations Ltd | Voice input for the AI assistant | Speech, converted to text | EU region | Not applicable: processing within the EEA |
Notes
Maventa uses its own service providers for the Peppol service. They are in the list that Visma publishes. Visma's sub-processor list
The following services are not in the table above because they are not sub-processors:
- Duende IdentityServer: Our own login service runs on the Microsoft Azure hosting listed above and is not a separate sub-processor.
- KBO Public Search: The KBO Public Search web service of the FPS Economy is a data source: we only send the enterprise number and receive data from the public register in return. The service does not process data on our behalf.
- Adsolut: Adsolut is an optional link that the accounting firm enables itself. The export goes to the SFTP server that is set for the firm. That is either a server the firm controls itself or the SFTP server that Invenza rents from Hetzner, which is listed above. On the server of Invenza the export files stay until the accounting software collects them. The firm is a separate recipient for that data and not our sub-processor.
- Yuki: Yuki is an optional link that the accounting firm enables itself. The destination is the firm's own administration at Yuki, and the firm is a separate recipient for that data and not our sub-processor.
Change log
- 29 October 2026 Change Since the merger of 1 October 2026, Maventa Oy is named Inexchange Oy. It is the same company, with the same Finnish Business ID 3478209-8, and the party with which Invenza concluded the contract for the Peppol service. This list previously named Visma Solutions Oy as the legal entity. The service, location and transfer basis are unchanged.
- 27 October 2026 Change Microsoft Azure AI Document Intelligence is now in use for text recognition (OCR) of uploaded invoices and receipts. The legal entity, data categories, location and transfer basis are unchanged.(Effective from: 28 October 2026)
- 21 October 2026 New sub-processor New sub-processor Hetzner Online GmbH. Invenza rents a server from Hetzner in a data centre in Germany (EU) that runs an SFTP server for the Adsolut export. When an accounting firm uses this server, the export files stay on it until the accounting software collects them. By exception, this sub-processor is used from the effective date without the usual notice of at least 30 days. The accounting firm can object within 30 days after the notice, by e-mail to privacy@invenza.be.(Effective from: 21 October 2026)
- 14 October 2026 Change The legal entity of Mailgun is now named: Mailgun Technologies, Inc., a Sinch group company. The service, location and transfer basis are unchanged.
- 8 October 2026 Initial publication First publication of the list of sub-processors.