Sub-processors
The third-party providers we engage to process personal data on your behalf, and the transfer safeguard that applies to each one.
Last updated: 2026-08-15
What this page covers
To run ClientFlow we rely on a small set of vetted service providers (“sub-processors”) that may process personal data on our behalf under Article 28 GDPR. The tables below list every active sub-processor, what it does, the categories of data it handles, where it processes that data, and the transfer mechanism that applies. Where a safeguard for a transfer outside the EU/EEA is not yet in force, the table says so rather than implying one is already in place.
Processed inside the EU/EEA
| Provider | Purpose | Data categories | Processing location | Documents |
|---|---|---|---|---|
Hetzner Cloud Hetzner Online GmbH | Cloud infrastructure & hosting |
| Frankfurt, Germany | |
Vercel Vercel Inc. | Frontend hosting & delivery |
| Frankfurt, Germany (FRA1) |
Transfer mechanism
| Provider | Purpose | Data categories | Processing location | Transfer mechanism | Documents |
|---|---|---|---|---|---|
Cloudflare Cloudflare, Inc. | Content delivery & file storage |
| Global edge network (EU primary storage) | Standard Contractual Clauses + EU–US Data Privacy Framework | |
iyzico iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. | Payment processing |
| Istanbul, Turkey | Standard Contractual Clauses (not yet in force) | |
Resend Resend, Inc. | Transactional email delivery |
| United States | Standard Contractual Clauses | |
Sentry Functional Software, Inc. (dba Sentry) | Error monitoring & diagnostics |
| United States | Standard Contractual Clauses | |
Google (OAuth, Analytics) Google LLC | Sign-in & authentication |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
Firebase Cloud Messaging Google LLC | Push notifications |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
WhatsApp Business API Meta Platforms Ireland Limited | WhatsApp messaging |
| Ireland (contracting) + global (Meta infrastructure) | Standard Contractual Clauses | |
Apple (Sign in with Apple) Apple Inc. | Sign-in & authentication |
| United States | Standard Contractual Clauses | |
Anthropic (Claude) Anthropic, PBC | AI assistant & chatbot processing |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
OpenAI OpenAI, L.L.C. | AI assistant & chatbot processing |
| United States | Standard Contractual Clauses + EU–US Data Privacy Framework | |
Groq Groq, Inc. | AI assistant & chatbot processing |
| United States | Standard Contractual Clauses (not yet in force) |
Changes to this list
When we add or replace a sub-processor, we update this page and bump its version date, and we email every account holder at the address on their account at least 14 days before the change takes effect. There is no separate subscription to manage. You may object to a new sub-processor as described in our Data Processing Agreement.
Questions
If you have questions about our sub-processors or the safeguards that apply to international transfers, contact our team.