Visbig does not host the models it runs on, and it does not store documents on its own disks. This is every third party that processes data on our behalf, what each one is used for, and what it actually sees. If a provider is not on this list, your data does not reach it.
AI providers
These are the ones that see the substance of your work: the text of your conversations and, for document processing, the contents of what you upload.
| Provider | Used for | What it sees | Place of processing |
|---|---|---|---|
| OpenAI | Speech to text, and embeddings that give the assistant memory of a thread | Spoken audio for the length of the request, and conversation text | United States |
| Google (Gemini) | Tax-law research, document extraction, deciding when you have finished speaking | Uploaded documents, and conversation text | United States |
| xAI | Routing your request and writing the reply | Conversation text | United States |
| DeepInfra | Tax and GST computation, filing formats, deadlines, client management, output scoring | Conversation text and the figures being computed | United States |
| Mistral AI | Reading text out of scanned PDFs and images | Uploaded documents | European Union |
| Smallest AI | Turning the assistant's reply into speech | The reply text, not your input | India |
| Firecrawl | Fetching government circulars and notifications | Nothing personal. Only public regulatory pages | United States |
Infrastructure and services
| Provider | Used for | What it sees | Place of processing |
|---|---|---|---|
| Sandbox (Quicko) | PAN and Aadhaar verification, GSTIN lookup, GST and TDS filing | PAN, Aadhaar number at the moment of verification, GSTIN, return payloads | India |
| Cloudflare | Document storage (R2), and the CDN and firewall in front of the site | Uploaded documents, and request metadata including your IP address | Global edge network |
| Cashfree Payments | Collecting payment for credits | Name, email, and the payment details you enter on their page | India |
| ZeptoMail (Zoho) | Verification codes, invoices and service email | Your email address and name | Zoho's data centres |
| Google (OAuth) | Signing in with Google, if you choose to | Your email address, name and profile image | United States |
Place of processing is the provider's primary jurisdiction for the service we use. Several of them operate globally and may route work between regions under their own terms, which is why we name a jurisdiction rather than a data centre.
What we run ourselves
The application, the PostgreSQL database holding your filings and client records, and the in-memory session store run on infrastructure we operate ourselves in Vienna, Austria, not on a managed third-party platform. That is where your data rests; everything in the tables above happens while a request is being served.
No analytics, error-tracking or product-telemetry service is installed anywhere in Visbig.
How we hold them to it
Each provider is engaged under terms that limit them to processing data for the purpose we engaged them for. We do not use your data to train models, and we do not sell it. Ask us at [email protected] and we will tell you which agreement is in place with any provider on this page. The transfer rules that govern all of it are on Data Protection and GDPR.
Changes to this list
We keep this page current. If we add a provider that processes personal data, the date at the top moves. To be told in advance, email [email protected] and ask to be notified of subprocessor changes.