Subprocessors
Not a signed DPA. Product owner owns customer contracts.
| Processor | Role | Data |
|---|---|---|
| Clerk | Identity, organizations, sessions | User and org identifiers, email |
| Render | App host, Postgres, cron | Tenant finance records, logs |
| OpenAI (when configured) | Intent parse / Ask fallback | Prompts. Official numbers stay engine-calculated. Do not send full P&L dumps as a default. |
Butler does not send pack amounts to Mixpanel or similar third-party analytics.