Subprocessors for the Clientflow portal
Published 5 September 2026. Last updated 6 September 2026.
Every third party that processes personal data on our behalf for portal.clientflow.ai, with what it processes, where, and the safeguard that covers any transfer outside the UK. Verified against each provider's own published terms on 2 Sep 2026; the citations are in our repository. We add a row before a new provider processes anything, not after.
| Provider | Legal entity | What it processes for the portal | Where | Transfer safeguard | Their own list |
|---|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd, Singapore (its DPA's processor entity) | The database, sign-in (magic links, sessions), file storage, and the sign-in audit log | London (AWS eu-west-2): Postgres, Auth and Storage objects are hosted in the chosen region. Support access may come from the United States or Singapore | Data Processing Addendum (supabase.com/legal/dpa) incorporating the EU standard contractual clauses and the UK ICO Addendum (B.1.0) | supabase.com/legal/customer-resources/subprocessor-list |
| Vercel | Vercel Inc., Delaware, United States | Hosting: the portal's server code (page rendering, actions, route handlers), the session-refresh middleware, static assets, and request logs kept for one day | Functions run in London (lhr1); the routing middleware runs at the edge nearest the visitor; static assets sit on the global CDN and carry no personal data | Data Processing Addendum (vercel.com/legal/dpa) incorporating the EU standard contractual clauses and the UK International Data Transfer Addendum; Vercel also states that it is certified under the EU–US Data Privacy Framework and its UK Extension | security.vercel.com/subprocessors |
| Resend | Plus Five Five, Inc., San Francisco, United States | Transactional email: the magic-link emails today; project notifications from Phase 5 | Sent from the domain's region; message content, delivery logs and webhook payloads are stored in the United States for 30 days on every plan | Data Processing Addendum (resend.com/legal/dpa) incorporating the EU standard contractual clauses with the UK Addendum; Resend states that it is certified under the EU–US Data Privacy Framework and its UK Extension. Open and click tracking are switched off for our domain | resend.com/legal/subprocessors |
| Sentry | Functional Software, Inc., San Francisco, United States | Error reports: the page and URL, request headers with secrets removed, the error and its technical detail. No cookies, no IP address, no session replay | EU region, Frankfurt (Google Cloud) for event data; account settings are held in the United States | Data Processing Addendum (sentry.io/legal/dpa): Sentry states that it is certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US framework, with the EU standard contractual clauses and the UK Addendum as fallback | sentry.io/legal/subprocessors |
| Stripe (from Phase 5) | Added when the account is opened | Deposit and balance payments by bank or card; we receive the amount, method, reference and status and never card or bank details | Added with the entity | Added with the entity | stripe.com/legal |
What is not on this list
- GitHub (GitHub, Inc., United States) holds our source code. Today the code's seed data names one client and one contact's work email; that seed is removed from the repository by Phase 8 item 8.9, and GitHub processes no other client data.
- Our own mailbox (hello@clientflow.ai) and the website are covered by the website's privacy policy.
Changes
We update this page before a new provider processes anything, and we review it in full before launch (Phase 8 item 8.7). Each version carries its date.