Privacy Terms
Subprocessors
Acua affiliates and third parties that process personal data on behalf of Acua customers.
Last updated: July 31, 2026
What is a subprocessor?
A subprocessor is an Acua affiliate or third party engaged by the Contracting Acua Entity to process personal data on behalf of a customer, where the customer is controller and Acua is processor. An Acua entity is listed as an affiliate subprocessor only when it processes customer personal data on behalf of a different Contracting Acua Entity. This terminology is used under our DPA and is applied consistently with Thailand's PDPA, Japan's APPI, Vietnam's Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, and other applicable law.
Why Acua uses subprocessors
Acua relies on established cloud, authentication, AI, messaging, and analytics providers so that the platform can be delivered securely and reliably across our operating regions. Using specialised providers for clearly defined functions — rather than building everything in-house — allows us to offer better security, higher availability, and faster incident response than Acua could practically achieve alone.
How we evaluate and onboard subprocessors
Before a new subprocessor is engaged, Acua reviews the provider against the following criteria, adjusted to the nature and volume of data the provider will process:
•Security posture, typically evidenced by SOC 2 Type II, ISO/IEC 27001, or an equivalent independent report •A written data processing agreement that includes GDPR Article 28 terms, applicable cross-border transfer mechanisms (for example, Standard Contractual Clauses), and a breach notification commitment •Scoping the provider's access to the minimum data necessary to deliver the relevant function ("least privilege") •A documented sub-subprocessor policy by the provider, so that we understand the downstream processing chain •Ongoing monitoring through re-review of each provider's security reports, or sooner if the scope of processing materially changes
Current subprocessors
The table below lists the Acua affiliate and third-party subprocessors currently used to process personal data as part of the Services. An affiliate row applies only when that entity is not the Contracting Acua Entity and processes data on its behalf. Regions reflect primary processing or access locations; some providers may replicate or back up data to additional regions under their published policies.
| Provider | Service / category | Purpose of processing | Data location / processing region | Applicable service area | Website | Notes |
|---|---|---|---|---|---|---|
| Acua (Thailand) Co., Ltd. | Group platform operations, accounting and finance-operations services, customer delivery, support, security, and administration | Primary operation and delivery of Acua products and related services, including support for customers contracted with another Acua entity | Thailand | All Acua services, where Acua Thailand is not the contracting entity | www.acua.ai/en/contact | An affiliate subprocessor only where it processes Customer Personal Data on behalf of another Contracting Acua Entity. |
| Acua Co., Ltd. (Japan) | Local customer delivery, support, group administration, and product and operational assistance | Delivery of services in Japan and assistance to other Acua entities where authorized | Japan | Japan services and authorized group support | www.acua.ai/en/contact | An affiliate subprocessor only where it processes Customer Personal Data on behalf of another Contracting Acua Entity. |
| Acua Vietnam Co., Ltd. | Product development, engineering, quality assurance, technical support, and limited local customer delivery | Development, maintenance, testing, troubleshooting, support, and authorized delivery of Acua products and services | Vietnam | All Acua services where engineering or authorized local support is required | www.acua.ai/en/contact | Access is role-based and limited to approved development, support, or service-delivery tasks. An affiliate subprocessor only where it processes Customer Personal Data on behalf of another Contracting Acua Entity. |
| Google LLC (Google Cloud Platform) | Application hosting, managed database (Cloud SQL), object storage (Cloud Storage) | Hosting of the Acua application and storage of customer account data and uploaded documents | Thailand (GCP region asia-southeast3, Bangkok) for production application and Cloud SQL. Object storage regions may include Japan. | All Acua services | cloud.google.com | Processing under Google Cloud’s Data Processing Addendum. |
| Google LLC (Google Document AI) | Document OCR and structured data extraction | Extract text and structured fields from invoices, receipts, and similar documents uploaded by customers | United States | Invoice processing, expense receipts, and other document-ingestion features | cloud.google.com/document-ai | Listed separately from Google Cloud Platform because processing occurs under a distinct Google service with its own regional footprint. |
| Google LLC (Vertex AI / Gemini) | Generative AI model inference | AI-assisted document understanding, data extraction, and text generation used by Acua features | Processed via Google Cloud (Vertex AI); regional availability depends on the specific model endpoint. | AI-assisted features across the Acua platform | cloud.google.com/vertex-ai | Contracting entity is Google LLC; data handling follows Google Cloud’s Data Processing Addendum. Customer content is not used to train general-purpose models under the Vertex AI terms. |
| Okta, Inc. (Auth0) | Authentication and identity management | User sign-in, session management, and identity-provider integration for the Acua application | Japan (Auth0 tenant region) | All Acua services | auth0.com | Contracting entity is Okta, Inc. (Auth0 was acquired by Okta in 2021). |
| Temporal Technologies, Inc. (Temporal Cloud) | Workflow orchestration | Durable execution of background workflows (for example, document processing pipelines and scheduled jobs) | Temporal Cloud namespace region; confirm current configuration with your Acua account team. | Acua services that rely on workflow orchestration | temporal.io | Workflow inputs and outputs may contain personal data embedded in workflow payloads. |
| Resend, Inc. | Transactional email delivery | Delivery of outbound transactional emails (account notifications, receipts, password resets) | United States (primary region) | All Acua services | resend.com | Email metadata (sender, recipient, subject, delivery status) is retained by Resend in accordance with its retention policy. |
| Wildbit LLC (Postmark) | Inbound email and webhook processing | Receiving and normalising inbound emails addressed to Acua (for example, invoices forwarded by customers) | United States (primary region) | Inbound email ingestion features | postmarkapp.com | Contracting entity is Wildbit LLC (operator of Postmark), an ActiveCampaign company. |
| PostHog Inc. | Product analytics | Usage analytics, feature-adoption measurement, and session analytics to improve the Acua product | PostHog Cloud (tenant region configured by Acua). | All Acua services | posthog.com | Acua configures PostHog to minimise the collection of personal data. See the Privacy Policy for cookies and tracking. |
| Slack Technologies, LLC | Slack integration delivery | Delivering Acua notifications and workflows into Slack workspaces where a customer has explicitly enabled the Slack integration | United States (Slack primary region). | Customers who enable the Slack integration | slack.com | Only applies to customers who opt in by installing the Acua Slack app. No Slack processing occurs for customers who do not enable the integration. |
Updates to this list
Acua reviews this list on an ongoing basis and will update this page when a new subprocessor begins processing personal data on behalf of customers, or when an existing subprocessor is removed. Customers with a signed data processing agreement that entitles them to advance notice of subprocessor changes will be notified in accordance with the notice mechanism described in that agreement. For customers on click-through or standard terms, the updated list on this page is the authoritative source; the "Last updated" date above reflects the most recent change.
Contact
Questions about this page or a listed subprocessor may be sent to privacy@acua.ai. Please identify your Contracting Acua Entity and country where known. The offices of Acua Thailand, Acua Japan, and Acua Vietnam are listed in our Privacy Policy and Contact page.