Sub-processors
The third-party providers we engage to process personal data on your behalf, and the safeguard that covers each one.
Last updated: 2026-06-02
What this page covers
To run ClientFlow we rely on a small set of vetted service providers (“sub-processors”) that may process personal data on our behalf under Article 28 GDPR. We hold a data processing agreement with each, and any processing outside the EU/EEA is covered by an appropriate transfer safeguard. The tables below list every active sub-processor, what it does, the categories of data it handles, where it processes that data, and the transfer mechanism that applies.
Processed inside the EU/EEA
| Provider | Purpose | Data categories | Processing location | Documents |
|---|---|---|---|---|
Hetzner Cloud Hetzner Online GmbH | Cloud infrastructure & hosting |
| Frankfurt, Germany | |
Vercel Vercel Inc. | Frontend hosting & delivery |
| Frankfurt, Germany (FRA1) |
Transfer mechanism
| Provider | Purpose | Data categories | Processing location | Transfer mechanism | Documents |
|---|---|---|---|---|---|
Cloudflare Cloudflare, Inc. | Content delivery & file storage |
| Global edge network (EU primary storage) | Standard Contractual Clauses + EU–US Data Privacy Framework | |
iyzico iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. | Payment processing |
| Istanbul, Turkey | Standard Contractual Clauses (signature in progress) | |
Resend Resend, Inc. | Transactional email delivery |
| United States | Standard Contractual Clauses | |
Sentry Functional Software, Inc. (dba Sentry) | Error monitoring & diagnostics |
| United States | Standard Contractual Clauses | |
Google (OAuth, Analytics) Google LLC | Sign-in & authentication |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
Firebase Cloud Messaging Google LLC | Push notifications |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
WhatsApp Business API Meta Platforms Ireland Limited | WhatsApp messaging |
| Ireland (contracting) + global (Meta infrastructure) | Standard Contractual Clauses | |
Apple (Sign in with Apple) Apple Inc. | Sign-in & authentication |
| United States | Standard Contractual Clauses | |
Anthropic (Claude) Anthropic, PBC | AI assistant & chatbot processing |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
OpenAI OpenAI, L.L.C. | AI assistant & chatbot processing |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
Changes to this list
When we add or replace a sub-processor, we update this page and bump its version date. Customers who have subscribed to sub-processor change notifications are notified in line with our Data Processing Agreement, and you may object to a new sub-processor as described there.
Questions
If you have questions about our sub-processors or the safeguards that apply to international transfers, contact our team.