Sub-processors
Flow State engages the third-party providers below to deliver its service. Last updated 2026-06.
| Provider | Role | Region | Transfer mechanism |
|---|---|---|---|
| Supabase (database + auth) | Primary data store + authentication | EU — AWS eu-central-1 (Frankfurt) — confirmed via Supabase dashboard 2026-06-17 | No international transfer (EU-resident) |
| OpenRouter (AI gateway) | AI request routing | United States | SCCs / UK IDTA (DPF where certified) |
| Anthropic (AI model host) | AI model provider | United States | SCCs / DPF (zero-retention, no training) |
| Resend (email) | Transactional email delivery | United States (EU domain pending) | SCCs / DPF |
| Sentry (monitoring) | Error & performance monitoring | EU — Germany | No international transfer (EU-resident) |
| Vercel (hosting) | Hosting & compute | United States (EU region pending) | SCCs / DPF |
We give customers at least 30 days' notice before adding or replacing a sub-processor that processes personal data. To be notified of changes, contact privacy@flowstatesales.com.