FlowProofsSub-processors
Last updated: October 24, 2026
These are the companies that process personal data for FlowProofs. This is the complete list.
1. Sub-processors
| Sub-processor | Purpose | Data processed | Location | Their terms |
|---|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage, backups | Account data, canvases, uploaded files and images, connection credentials (encrypted), sign-in records, data export files (kept 24 hours) | not yet published | DPA |
| Vercel Inc. | Application hosting and content delivery | Everything the app serves passes through it; IP addresses and access logs | Singapore (Vercel sin1), plus global edge locations | DPA |
| Anthropic PBC | AI features, only when you use one: written summaries, the assistant, formulas from a description, report imports | The variable names, values, relationships and text each request needs. Not used to train models | United States | Commercial terms and DPA |
| Resend, Inc. | Email delivery: contact form messages, account emails, up to three getting-started emails | Email address, first name; for contact messages, name, email, topic and message | United States | DPA |
| PostHog Inc. | Product analytics in the signed-in app, only for people who agreed to it | Account id, named feature events with counts and settings, device and browser type. No canvas content, values or text, no recordings | United States (or the EU, if the EU region is used) | DPA |
| Functional Software, Inc. (Sentry) | Error monitoring | Error details, code location, browser and device type, page address without query strings, IP address (not stored). Request bodies, cookies and canvas content are removed | United States | DPA |
| Google LLC (Google Analytics 4) | Website analytics on the public website only, and only after the visitor accepts | Pages visited, device and browser type, approximate location. IP addresses are not logged or stored by GA4 | United States | Data processing terms |
2. Services we call when you connect them
When you connect a data source yourself, FlowProofs reads the data you select from that service on your behalf, using the access you gave. These services are your own providers rather than our sub-processors, but they are listed here so the picture is complete:
| Service | What FlowProofs does | Their terms |
|---|---|---|
| Google LLC (Sheets, Drive, Analytics APIs) | Reads the spreadsheets and reports you choose, read-only. Covered by Google's Limited Use rules (see the Privacy Policy, section 10) | API User Data Policy |
| Microsoft Corporation (Microsoft Graph) | Reads the Excel files on OneDrive or SharePoint you choose, read-only | Products and Services DPA |
| HubSpot, QuickBooks (Intuit), Stripe, Notion, PostgreSQL databases | Read the records or tables you choose, read-only | Each service's own terms |
We send these services nothing but the requests needed to read what you chose.
3. Changes to this list
We will notify registered users by email at least 30 days before adding or replacing a sub-processor, and update this page. If you object, write to privacy@flowproofs.com within 30 days of that notice; business customers have the rights in the Data Processing Addendum.
4. Sub-processors removed
None to date.