Sub-processors
Flowsign uses the third-party service providers listed below to run the service. Each is bound by written agreement to protect the personal information we entrust to them at a standard comparable to the New Zealand Privacy Act 2020, and each is subject to a recognised privacy or data-protection framework in its home jurisdiction.
Customer documents, database records and backups are stored in Australia, or in New Zealand for Enterprise customers with a dedicated database. Providers that hold data for us do so as our agent under section 11 of the Privacy Act 2020, so the information remains held by Flowsign for the purposes of that Act.
Read this page together with our Privacy Policy and, for business customers, our Data Processing Addendum.
Core infrastructure
Providers that host Flowsign or handle the documents and data behind it.
| Provider | Purpose | Location | Details |
|---|---|---|---|
| Supabase (opens in a new tab) | Managed Postgres database, file storage for uploaded and signed PDFs, and authentication | Australia (AWS ap-southeast-2, Sydney) | Supabase Pte. Ltd (Singapore), with support access from Supabase, Inc. (United States). Holds data as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Amazon Web Services (opens in a new tab) | Application hosting for the Flowsign web apps and background workers, and the dedicated database for Enterprise customers who choose New Zealand hosting | Australia (AWS ap-southeast-2, Sydney); New Zealand (AWS Auckland) for an Enterprise dedicated database | Amazon Web Services. Holds data as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
Operational providers
Providers that support billing, communications, security and reliability.
| Provider | Purpose | Location | Details |
|---|---|---|---|
| Stripe Payments New Zealand Limited (opens in a new tab) | Subscription billing, payment processing, and payment-method storage | New Zealand, with card processing by Stripe, Inc. (United States) | Collects payment details as an agency in its own right. Onward transfer to Stripe, Inc. relies on IPP 12(1)(f) and Stripe's binding intra-group data-protection framework. |
| Resend (opens in a new tab) | Transactional email delivery - signing invitations, reminders, receipts, security notices | United States | Holds recipient email addresses and message content as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Sentry (opens in a new tab) | Application error monitoring and crash reporting | European Union (Germany) | Holds error reports as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| incident.io (opens in a new tab) | Public status page at status.flowsign.app, incident updates, and emails to people who subscribe to them | European Union (Google Cloud) | Pineapple Technology Ltd (United Kingdom), trading as incident.io. Holds status page subscriber email addresses and incident details as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Cloudflare (opens in a new tab) | Bot and abuse protection on sign-in and contact forms (Turnstile), and forwarding of email sent to flowsign.app addresses | United States, served from Cloudflare's global network | Cloudflare, Inc. (United States). Processes IP addresses, browser signals and forwarded email as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Google Workspace (opens in a new tab) | Staff email, including privacy, legal and support requests, and staff sign-in | United States | Google LLC (United States). Holds email content and contact details as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
Notification of changes
This list will change from time to time as Flowsign evolves. We update this page whenever a sub-processor is added, removed, or replaced. Business customers under a Data Processing Addendum are notified by email at least 30 days in advance of a new sub-processor that will handle their data. To set or change the address we notify, email legal@flowsign.app.
Questions
If you have questions about a specific sub-processor or the safeguards in place, contact our Privacy Officer at privacy@flowsign.app.