Subprocessors
This list identifies subprocessors that may process personal data on behalf of Arnstein Banking Systems in connection with the CornerStone Agentic Score Service. It supports our Privacy Policy and GDPR Article 28.
Last updated: February 8, 2026. We may update this list when we add or change subprocessors. We will post the updated list on this page; continued use of the Service after the effective date of changes constitutes acceptance.
| Subprocessor | Purpose | Data processed | Location / transfer | Safeguards |
|---|---|---|---|---|
| Plaid, Inc. | Bank linking: we obtain link tokens and exchange public tokens; we store only access token and item id per linked account. We do not open or hold bank accounts. | Identifiers (e.g. client user id), product/country; end-user data as per Plaid Link and Plaid’s terms. We do not store raw bank or transaction data. | USA; transfers as per Plaid’s legal. | Plaid’s terms and DPA; standard contractual clauses or other approved mechanisms where required. |
| RevenueCat | Subscription management and analytics for lender and paid features. | App user id, subscription state; PII as per RevenueCat’s privacy policy. | USA / as per RevenueCat. | RevenueCat terms and DPA; standard contractual clauses where required. |
| Stripe | Payment processing when used for subscriptions or one-off payments. | Billing and payment data as per Stripe’s privacy policy. | USA / global as per Stripe. | Stripe’s terms and DPA; standard contractual clauses where required. |
| Hosting / infrastructure | Servers, databases, and technical operations that host or process application data. | Data at rest and in transit as necessary to operate the Service (e.g. allowlist, Plaid connection metadata, lender accounts). | Depends on deployment (e.g. EU, USA). | Appropriate agreements (DPA, SCCs) with the provider in use. |
We do not sell your personal data. For questions about subprocessors or to request a data processing agreement, contact privacy@arnstein.ch.