Sub-processors
Last updated: May 2026
Flitch Solutions Pty Ltd engages the following third parties as Sub-processors to provide the Flitch services. This list is incorporated into the Flitch Data Processing Addendum and is updated as Sub-processors change.
We notify customers at least fifteen (15) days before enabling a new Sub-processor or replacing an existing one. Customers may object on reasonable data-protection grounds within ten (10) days of notification.
1. Current Sub-processors
All Sub-processors are SOC 2 Type II attested or equivalent.
Vercel Inc.
- Service: Application hosting and serverless compute for the Flitch web application and APIs.
- Data categories: All Customer Personal Data transiting the web application.
- Processing location: United States (primary), with global edge.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework where certified.
Neon Inc.
- Service: Managed PostgreSQL database for application data.
- Data categories: Account data, dashboard metadata, encrypted source credentials, audit logs.
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment.
DigitalOcean LLC
- Service: Managed Valkey cache for published dashboard query results.
- Data categories: Cached query results (5-minute TTL). BullMQ job queue state.
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment.
Amazon Web Services, Inc.
- Service: S3 object storage for dashboard assets, exports, and user-uploaded files.
- Data categories: Dashboard files, exported images and PDFs, user-uploaded attachments.
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework.
Anthropic, PBC
- Service: AI inference (Claude API) for dashboard generation, content suggestions, and updates.
- Data categories: User prompts, dashboard schemas, data samples (as included in user prompts).
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. Anthropic does not use API inputs to train models per commercial API terms. Zero Data Retention available for enterprise contracts on request.
Google LLC
- Service: AI inference (Gemini API) for dashboard generation and content tasks.
- Data categories: User prompts, dashboard schemas, data samples (as included in user prompts).
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework. Google does not use API inputs to train models per commercial API terms.
Stripe Inc.
- Service: Payment processing for subscriptions and billing.
- Data categories: Billing contact details, payment method tokens (Flitch does not store full card data).
- Processing location: United States.
- Transfer mechanism: EU SCCs (Module 3), UK Addendum, Swiss amendment. EU-US Data Privacy Framework.
2. Optional and Customer-controlled
The following are engaged only when a customer chooses to connect them. They process Customer Personal Data under the customer's own contractual relationship with the provider, not as Flitch Sub-processors:
- Customer's connected data sources (Snowflake, BigQuery, Postgres, MySQL, Salesforce, HubSpot, etc.). Flitch queries these on the customer's behalf using credentials the customer provides.
- Customer's chosen SSO identity provider (Google Workspace, Microsoft Entra ID, Okta, etc.) when SSO is enabled.
3. Change History
- 2026-05-28: Initial list published. DigitalOcean engaged as cache provider (replacing the previous arrangement) following migration to a TLS-capable managed Valkey instance.
4. Notification
To subscribe to sub-processor change notifications, email [email protected] with the subject "Sub-processor notifications" and include the email address to notify.
5. Contact
Questions about this list: