Sub-processors

Vercel Inc.

• Service: Application hosting and serverless compute for the Flitch web application and APIs.
• Data categories: All Customer Personal Data transiting the web application.
• Processing location: United States (primary), with global edge.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework where certified.

Railway Corp.

• Service: Hosting for the viewer for published dashboards, reports and apps (view.flitch.io), the compile service, and the generation, update, connector and workflow workers.
• Data categories: Code and content of published dashboards, reports and apps, data fetched from connected sources during generation, refresh, publishing and workflow runs, and viewer requests to them.
• Processing location: Singapore.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment.

Cloudflare, Inc.

• Service: Edge proxy in front of the viewer for published dashboards, reports and apps, including custom domains, with a fallback page when the origin is unavailable.
• Data categories: Requests to published dashboards, reports and apps, including IP address and request metadata.
• Processing location: United States, with global edge.
• Transfer mechanism: EU-US Data Privacy Framework, UK Extension, and Swiss-US Data Privacy Framework. EU SCCs (Module 3) and UK Addendum incorporated in the Cloudflare customer DPA.

Neon Inc.

• Service: Managed PostgreSQL database for application data.
• Data categories: Account data, metadata for dashboards, reports and apps, encrypted source credentials, audit logs.
• Processing location: Australia (Sydney).
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment.

DigitalOcean LLC

• Service: Managed Valkey cache for query results of published dashboards, reports and apps.
• Data categories: Cached query results (5-minute TTL). BullMQ job queue state.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment.

Amazon Web Services, Inc.

• Service: S3 object storage for assets of dashboards, reports and apps, exports and user-uploaded files. Amazon Bedrock for AI inference, used when a primary provider is unavailable. Simple Email Service for transactional email and for email sent by customer workflows.
• Data categories: Files of dashboards, reports and apps, exported images and PDFs, user-uploaded attachments. User prompts, their schemas and data samples where inference runs on Bedrock. Recipient address and message content for transactional email, and for email a customer workflow sends, which can include rows from the customer's data.
• Processing location: Australia (Sydney) for S3 object storage. United States for Bedrock and Simple Email Service.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework. AWS does not use Bedrock inputs to train models per its service terms.

Anthropic, PBC

• Service: AI inference (Claude API) for building and updating dashboards, apps, reports and workflows, content suggestions, and the default model for AI steps in customer workflows.
• Data categories: User prompts, schemas of dashboards, reports and apps, data samples (as included in user prompts), and the rows and documents that reach an AI step in a customer workflow.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. Anthropic does not use API inputs to train models per commercial API terms. Zero Data Retention available for enterprise contracts on request.

OpenAI, L.L.C.

• Service: AI inference (GPT API) for generation, editing, the data assistant, published Ask AI and AI steps in workflows, where a team selects it.
• Data categories: User prompts, schemas of dashboards, reports and apps, data samples (as included in user prompts), and the rows and documents that reach an AI step in a customer workflow where that step uses it.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. OpenAI does not use API inputs to train models per its API data usage policies, and retains API data for a limited period for abuse monitoring.

X.AI LLC

• Service: AI inference (Grok API) for generation, editing, the data assistant, published Ask AI and AI steps in workflows, where a team selects it.
• Data categories: User prompts, schemas of dashboards, reports and apps, data samples (as included in user prompts), and the rows and documents that reach an AI step in a customer workflow where that step uses it.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. xAI does not use API inputs to train models per its enterprise API terms.

Mistral AI SAS

• Service: Document reading (OCR) for a workflow step set to read pages before extracting from them. Not used for inference, and not engaged unless a step asks for it.
• Data categories: Uploaded documents and the pages rendered from them, and the text read back out of them.
• Processing location: European Union (France).
• Transfer mechanism: No transfer mechanism is needed for processing in the EU. Where Mistral engages a sub-processor outside it, its Data Processing Addendum incorporates EU SCCs. Mistral does not use paid API inputs to train models, and retains them for a limited period for abuse monitoring.

Google LLC

• Service: AI inference (Gemini API) for generation, content tasks, and AI steps in workflows where a team selects it.
• Data categories: User prompts, schemas of dashboards, reports and apps, data samples (as included in user prompts), and the rows and documents that reach an AI step in a customer workflow where that step uses it.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework. Google does not use API inputs to train models per commercial API terms.

Replicate, Inc.

• Service: Image generation for icons of dashboards, reports and apps.
• Data categories: A short visual description of the icon, written by us from its subject. None of its data, no source data, no account details. Replicate removes the inputs, outputs and logs of an API prediction after one hour.
• Processing location: Not published by the provider.
• Transfer mechanism: Being established with the provider. No personal data is intended to reach this service.

PostHog Inc.

• Service: Product analytics and session replay for the Flitch application.
• Data categories: Usage events, page views, and for visitors who consent, session recordings of the Flitch interface. Recording is off on published dashboards, reports and apps and on the editor preview, so an author's audience is never recorded.
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum.

Functional Software, Inc. (Sentry)

• Service: Error monitoring and performance tracing for the Flitch application.
• Data categories: Error messages, stack traces, request metadata and the account identifier of the person who hit the error. Session replay follows the same consent and surface rules as analytics.
• Processing location: United States.
• Transfer mechanism: EU-US Data Privacy Framework, UK Extension, and Swiss-US Data Privacy Framework. EU SCCs and the UK International Data Transfer Agreement incorporated in Sentry's DPA.

Stripe Inc.

• Service: Payment processing for subscriptions and billing.
• Data categories: Billing contact details, payment method tokens (Flitch does not store full card data).
• Processing location: United States.
• Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework.