Sub-processors
FlowSign uses the third-party service providers listed below to run the service. Each is bound by written agreement to protect the personal information we entrust to them at a standard comparable to the New Zealand Privacy Act 2020, and each is subject to a recognised privacy or data-protection framework in its home jurisdiction.
Customer documents, database records and backups are stored in Singapore. Providers that hold data for us do so as our agent under section 11 of the Privacy Act 2020, so the information remains held by FlowSign for the purposes of that Act.
Read this page together with our Privacy Policy and, for business customers, our Data Processing Addendum.
Core infrastructure
Providers that host FlowSign or handle the documents and data behind it.
| Provider | Purpose | Location | Details |
|---|---|---|---|
| Supabase (opens in a new tab) | Managed Postgres database, file storage for uploaded and signed PDFs, and authentication | Singapore (AWS ap-southeast-1) | Supabase Pte. Ltd (Singapore), with support access from Supabase, Inc. (United States). Holds data as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Railway (opens in a new tab) | Application hosting for the FlowSign web apps and background workers | Singapore (Railway Southeast Asia region) | Railway Corporation (United States). Holds data as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. Railway's own infrastructure providers are listed on its Trust Center. |
Operational providers
Providers that support billing, communications and reliability.
| Provider | Purpose | Location | Details |
|---|---|---|---|
| Stripe Payments New Zealand Limited (opens in a new tab) | Subscription billing, payment processing, and payment-method storage | New Zealand, with card processing by Stripe, Inc. (United States) | Collects payment details as an agency in its own right. Onward transfer to Stripe, Inc. relies on IPP 12(1)(f) and Stripe's binding intra-group data-protection framework. |
| Resend (opens in a new tab) | Transactional email delivery - signing invitations, reminders, receipts, security notices | United States | Holds recipient email addresses and message content as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
| Sentry (opens in a new tab) | Application error monitoring and crash reporting | United States | Holds error reports as our agent under s 11 of the Privacy Act 2020; data processing addendum in place. |
Notification of changes
This list will change from time to time as FlowSign evolves. We update this page whenever a sub-processor is added, removed, or replaced. Business customers under a Data Processing Addendum are notified by email at least 30 days in advance of a new sub-processor that will handle their data. To set or change the address we notify, email [email protected].
Questions
If you have questions about a specific sub-processor or the safeguards in place, contact our Privacy Officer at [email protected].