Flow Subprocessors

Version: 2026-08-07 · Last updated: August 7, 2026

Flow Labs LLC (“Flow”) engages the third-party service providers listed below (“Subprocessors”) to help deliver the Flow platform. This page is maintained under Section 5 of our Data Processing Agreement and is referenced by our Privacy Policy.

A Subprocessor is a company that processes personal data on Flow’s behalf in order to provide part of the Service. Each one is bound by a written agreement imposing data-protection obligations no less protective than those in our DPA, and each may access personal data only to perform services for us.

Active subprocessors

Subprocessor

Service provided

Personal data processed

Processing location

Vercel Inc.

Application hosting, content delivery, and serverless functions

All data transiting the Service; request metadata and server logs

United States

Supabase, Inc.

Primary database (PostgreSQL) and file storage

All Customer Content, including files, documents, messages, tasks, deliverables, form responses, and invoice records

United States

Clerk, Inc.

Authentication, session management, multi-factor authentication, user directory, and invitation email

Account identifiers: name, email address, username, hashed password, profile photo, organization membership, authentication events

United States

PostHog, Inc.

Product analytics (PostHog US Cloud)

Pseudonymous usage events, user identifier, email, role, device and browser information, IP-derived approximate location. Does not receive Customer Content — see note below

United States

Google LLC

Business email (Google Workspace) — support and transactional correspondence

Email address and the contents of correspondence with our team

United States

Note on analytics scope

PostHog is deliberately constrained so that it does not receive our customers’ business information:

  • Session replay is disabled — no screen recordings or reconstructions are captured.

  • The visible text of interacted elements is stripped before events are transmitted, so client names, project titles, message content, and financial figures cannot reach PostHog. Element type and selector are retained so that usage analytics still function.

  • Personal-data masking is applied to automatically captured events.

  • Analytics requests are routed through p.theflowtool.com, a first-party relay to PostHog. This affects delivery only, not what is collected or who receives it.

Planned subprocessors

We disclose these in advance. They are not currently active and process no data today.

Subprocessor

Service

Expected activation

Stripe, Inc.

Payment processing for paid subscription plans

On launch of paid plans. We will update this page and notify customers before any payment data is processed.

Infrastructure and data location

All Subprocessors listed above process data in the United States. Flow does not currently transfer Customer Content outside the United States. Our Services are not offered in the European Economic Area, the United Kingdom, or Switzerland.

Changes to this list

We will provide at least 30 days’ advance notice before adding a new Subprocessor that will process Customer Content, by email to organization administrators and by updating this page. Customers may object to a new Subprocessor as described in Section 5.3 of the Data Processing Agreement.

To receive notifications of changes to this list, email support@theflowtool.com with the subject “Subprocessor Notifications.”

Flow Labs LLC · 13620 Weinstein Court, Centreville, Virginia 20120 · support@theflowtool.com