Sub-processors
Flow State engages the third-party providers below to deliver its service. Last updated 2026-07-03.
| Provider | Role | Region | Transfer mechanism |
|---|---|---|---|
| Supabase (database + auth) | Primary data store + authentication | EU — AWS eu-central-1 (Frankfurt) — confirmed via Supabase dashboard 2026-06-17 | No international transfer (EU-resident) |
| OpenRouter (AI gateway) | AI request routing | United States | SCCs / UK IDTA (DPF where certified) |
| Anthropic (AI model host) | AI model provider | United States | SCCs / DPF (zero-retention, no training) |
| Resend (email) | Transactional email delivery | European Union (eu-west-1) | No international transfer (EU-resident) |
| Sentry (monitoring) | Error & performance monitoring | EU — Germany | No international transfer (EU-resident) |
| Vercel (hosting) | Hosting & compute | European Union (Frankfurt, fra1) | No international transfer (EU-resident) |
| LearnWorlds (training LMS) | Point-of-need training — single sign-on to the linked lesson (receives the signed-in user's login email only) | Verification pending with vendor | Under review — contact privacy@ for current status |
We give customers at least 30 days' notice before adding or replacing a sub-processor that processes personal data. To be notified of changes, contact support@flowstatesales.co.uk.