Sub-Processors

This page lists the third-party service providers ("sub-processors") that FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore, engages to process personal data on behalf of customers of the FlowFn Service. This list is provided in accordance with our Data Processing Agreement and Article 28 of the EU General Data Protection Regulation. We will update this page when sub-processors are added or removed and, where required, notify customers in advance.

(a) Amazon Web Services, Inc. (AWS) — cloud compute for dedicated single-tenant worker servers where a customer's plan includes one, object storage (S3), content delivery (CloudFront), transactional email delivery (Simple Email Service), DNS, and related infrastructure. Primary processing region: AWS US East (N. Virginia) us-east-1, with disaster-recovery snapshots in the United States. AWS is self-certified under the EU-US Data Privacy Framework (and the UK Extension and Swiss-US DPF). Website: https://aws.amazon.com/compliance/gdpr-center/. (b) DigitalOcean, LLC — application hosting (the servers that run our web application and API), managed MongoDB database hosting, the compute for background job processing (such as workflow and agent runs) and scheduled tasks, and the compute for our custom-domain edge (a server in DigitalOcean's New York region that terminates TLS for customer custom domains and forwards each request to our web application). Primary processing region: DigitalOcean New York (NYC), with managed MongoDB in New York 3 (NYC3) — United States East Coast, in the same geographic area as our AWS us-east-1 deployment. Requests to our web application and API reach DigitalOcean's application-hosting service over the network of Cloudflare, Inc., which DigitalOcean engages as its own sub-processor for that service: Cloudflare terminates TLS at its network edge and forwards each request to DigitalOcean's New York region; it may briefly cache publicly cacheable content such as static site assets, but it is not used to store customer application data. Cloudflare is not in front of our custom-domain edge: a visitor's connection to a customer custom domain terminates TLS on that edge server, not at Cloudflare; the edge server then forwards the request to our web application, and that forwarded request reaches the application-hosting service over Cloudflare as described above. DigitalOcean is bound by its Data Processing Agreement and the Standard Contractual Clauses incorporated into it for international transfers; that agreement also governs DigitalOcean's use of its own sub-processors, including Cloudflare (listed at https://www.digitalocean.com/trust/subprocessors). Website: https://www.digitalocean.com/legal/privacy-policy. (c) Upstash, Inc. — managed Redis hosting used as the in-memory cache and background-job queue for our BullMQ worker system (enqueueing notifications, workflow run jobs and other asynchronous tasks). Primary processing region: US East (N. Virginia) us-east-1 — United States East Coast (Upstash runs on cloud infrastructure in the region of our choosing). Upstash is bound by its Data Processing Addendum and the Standard Contractual Clauses incorporated into it. Website: https://upstash.com/trust/privacy.pdf. (d) Internet Security Research Group (ISRG), operator of Let's Encrypt — automated issuance and renewal of the TLS/SSL certificates that secure customer custom domains served through our custom-domain edge (which itself runs on the DigitalOcean infrastructure described in (b)). When a visitor first connects to a customer-controlled hostname, our edge requests a certificate for that exact hostname from Let's Encrypt over the ACME protocol; the hostname being secured, together with the metadata needed to validate control of it, is transmitted to ISRG. ISRG is a California-based non-profit certificate authority; issuance is governed by its Subscriber Agreement and Privacy Policy. Website: https://letsencrypt.org/privacy/.

Stripe, Inc. (and its regional affiliates including Stripe Payments Singapore Pte. Ltd.) — payment processing, billing, invoicing, tax calculation, fraud prevention, and storage of payment-method data. Stripe acts as an independent controller for payment-card data under PCI-DSS. Website: https://stripe.com/privacy.

FlowFn engages the following AI model providers as sub-processors for its built-in AI features. The provider used for a given request is determined by the model selected on your team's AI preferences. (a) OpenAI, L.L.C. — large language model inference (e.g. GPT-4o / GPT-5 family) and image generation. Website: https://openai.com/policies/privacy-policy. (b) Anthropic, PBC — large language model inference (Claude family). Website: https://www.anthropic.com/legal/privacy. (c) Google LLC — Gemini and Veo APIs for language, image, and video model inference. Website: https://policies.google.com/privacy. (d) X.AI Corp. — large language model inference (Grok family) via the xAI API. Website: https://x.ai/legal/privacy-policy. We engage these providers for: (i) the in-product AI Assistant (chat-style help inside the dashboard); (ii) the workflow Code Generator and workflow AI Assistance; (iii) the Playground AI assistant (chat-driven HTML / CSS / JavaScript authoring and data-sheet proposals inside Playgrounds); and (iv) workflow nodes that invoke a platform-managed model when your subscription plan includes platform-managed model access (in that case the call goes out under FlowFn's API key and FlowFn pays the provider). Each provider is engaged only on demand, when you or a workflow you have authored invokes one of those features. We send only the prompt, attached context, and any files you upload (including images attached to chat messages in the AI Assistant or Playground AI assistant) for that specific request; we do not use customer prompts or outputs to train these providers' models, and each provider is contractually prohibited from doing so under their enterprise terms with FlowFn. If you do not use the AI features no inputs are sent. Customers who configure their own provider API key on their team (BYOK) instead invoke that provider under their own contract; see Section 7 for how we treat customer-connected vendors. See our AI Disclosure for further detail.

(a) Google LLC (Google Analytics 4) — aggregate website analytics on the marketing site only. Loaded only after you grant analytics consent through our cookie banner. Not used for users who decline analytics cookies. Website: https://policies.google.com/privacy. (b) Google LLC (Google Ads conversion measurement) — measures whether a marketing-site visit or signup followed one of our ads. Loaded on the marketing site only and only after you grant advertising & measurement consent through our cookie banner; configured for conversion measurement only — ad-personalization signals are denied and Google's ads-data redaction is enabled; we do not use remarketing or cross-context behavioural advertising. Website: https://policies.google.com/privacy. We do not currently use any third-party product analytics, session-replay, or behavioural-advertising vendor inside the authenticated dashboard.

Google LLC (reCAPTCHA v3) — invisible, score-based bot and abuse detection on our unauthenticated entry points: account sign-up and sign-in, and public form submissions served from FlowFn-hosted origins (the /f/<slug> pages on flowfn.com or a <tenant>.flowfn.com subdomain — including the form iframe that embedded forms load from those origins). When one of these is submitted, reCAPTCHA sends the visitor's IP address, a reCAPTCHA cookie identifier, and interaction signals to Google and returns a risk score that we use to allow or reject the request; there is no visible challenge. Forms served on a customer's own custom (white-label) domain do not invoke reCAPTCHA — it cannot verify a third-party origin — and are instead protected by the per-form embed token, the allowed-domains list, and rate limiting. reCAPTCHA makes no call elsewhere in the product. Google acts as our sub-processor for this purpose, bound by its terms and the Standard Contractual Clauses incorporated into them; transfers are covered by the safeguards in §8. See also our Cookie Policy. Website: https://policies.google.com/privacy.

Amazon Web Services, Inc. (AWS Simple Email Service, "SES") — transactional and notification email delivery (account confirmations, password resets, billing receipts, sub-processor change notices, workflow alerts, and similar service messages). SES operates in our primary AWS region (US East / N. Virginia, us-east-1) under the same AWS sub-processor terms set out in §2 above. Website: https://aws.amazon.com/privacy/.

When you connect a third-party tool to your workflow, that third party becomes an independent controller or processor for the data you send to it. Those vendors are configured by you using your own credentials (API key, OAuth token, database connection string, etc.), governed by your direct relationship with them, and are not listed as our sub-processors. We act on your documented instructions when we relay data to them. Two broad categories are available in the product: (i) communications, storage, and data tools (for example email senders, marketing platforms, and customer-managed databases); and (ii) bring-your-own-key (BYOK) AI service providers exposed as workflow nodes for tasks such as text, image, video, audio, and code generation. AI service providers in category (ii) are workflow tools, not FlowFn sub-processors: production use requires you to configure that provider's API key on your team, and the call goes out under your direct contract with the provider. The complete and current catalog of supported third-party tools (including AI providers) is published in the product, and the AI providers currently exposed as BYOK workflow nodes are also enumerated in our AI Disclosure for transparency.

FlowFn's primary processing region is in the United States East Coast: AWS us-east-1 (N. Virginia) for S3 object storage, CloudFront, Simple Email Service and, where a customer's plan includes one, dedicated single-tenant worker servers; DigitalOcean New York (NYC) for web application and API hosting, for background-job and scheduled-task compute, and for our custom-domain edge, and New York 3 (NYC3) for managed MongoDB database hosting; and Upstash in US East (us-east-1) for in-memory cache and background-job queue. Personal data is therefore routinely transferred from the European Economic Area, the United Kingdom, Switzerland and Singapore to the United States. We rely on the following safeguards: (a) the European Commission's Standard Contractual Clauses (Module 2 Controller-to-Processor between FlowFn and customer-controllers, Module 3 Processor-to-Processor between FlowFn and our sub-processors); (b) the UK International Data Transfer Addendum and the Swiss FDPIC's amendments where applicable; (c) the EU-US Data Privacy Framework (and its UK Extension and Swiss-US DPF) where the relevant US recipient is self-certified; and (d) for transfers out of Singapore, Section 26 of the Singapore PDPA and the Personal Data Protection (Transfer of Personal Data Outside Singapore) Regulations 2014, on the basis that AWS, DigitalOcean, Upstash and our other sub-processors are bound by data-processing addenda that impose obligations comparable to the protection under the PDPA. Sub-processor agreements include data-protection terms equivalent to those in our Data Processing Agreement. We have performed an internal Transfer Impact Assessment for the United States East Coast transfer (covering AWS us-east-1, DigitalOcean New York (including NYC3) and Upstash) and refresh it on material change.

We will update this page before engaging a new sub-processor or replacing an existing one. We send every active account holder advance notice by email at least 30 days before a new sub-processor begins processing personal data. This notice is a transactional service communication required by our Data Processing Agreement and by Article 28(2) of the GDPR / UK GDPR — it is not a marketing message and there is no opt-out, so even if you have opted out of marketing emails you will still receive these notices while you hold an account. Customers under a separate Data Processing Agreement will additionally receive notice through their DPA contact and may object in writing in accordance with the DPA. Any questions can be addressed to legal@flowfn.com.

Questions about this list, sub-processor security, or data transfers may be sent to our Data Protection Officer at legal@flowfn.com. General support: https://www.flowfn.com/dashboard/support.