Last updated: September 24, 2026
1. About this Addendum
This Data Processing Addendum ("DPA") is between Harbor Software LLC, a Wyoming limited liability company, which operates Flowboard ("Harbor", "we", "us"), and the business that accepted the Terms of Service ("Customer", "you"). It forms part of the Terms of Service and is incorporated into them by reference. In this DPA, "Agreement" means the Terms of Service together with the documents that form part of them, including this DPA.
This DPA applies automatically whenever we process Customer Personal Data in providing the Service. You accept it when you accept the Terms of Service, and no separate signature is needed. If your own procurement or records require a signed copy, email legal@flowboardhq.com and we will send you a PDF of this DPA signed by Harbor. A signed copy has the same content as this page and does not change its terms.
By accepting the Agreement, you and Harbor also enter into the Standard Contractual Clauses and the UK Addendum, as section 12 describes, as if each party had signed them, including their annexes as completed by the Annexes to this DPA.
2. Definitions
Terms defined in the Terms of Service have the same meaning in this DPA. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA. In this DPA:
- "Applicable Data Protection Law" means the laws on the protection of personal data that apply to a party's processing of Customer Personal Data under the Agreement, including, where they apply, the GDPR, the UK GDPR, the Swiss FADP and the CCPA.
- "Authorized Users" means your team members and your client users, as the Terms of Service describe them.
- "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
- "Customer Content" means the data that you, your team members and your client users put into the Service, including data submitted through your public forms, booking pages and proposal pages.
- "Customer Personal Data" means personal data within Customer Content, and personal data about your Authorized Users that we process to provide your workspace, in each case processed by Harbor on your behalf under the Agreement. It does not include the data described in section 3.3.
- "GDPR" means Regulation (EU) 2016/679.
- "Owner" means the team member who holds the Owner role in your workspace.
- "Restricted Transfer" means a transfer of Customer Personal Data from you to Harbor, or an onward transfer by Harbor, to a country that the GDPR, the UK GDPR or the Swiss FADP, as applicable, does not recognize as providing an adequate level of protection.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
- "Sub-processor" means a third party that Harbor engages to process Customer Personal Data on your behalf.
- "Swiss FADP" means the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances.
- "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022.
- "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom, read with the Data Protection Act 2018.
3. Scope and roles
3.1 Our roles
You are the controller of Customer Personal Data, and Harbor is your processor. Where you process Customer Personal Data as a processor for your own clients, you remain that processor and Harbor is your sub-processor. In that case you confirm that your controller has authorized your instructions to us, including our appointment and our use of Sub-processors, and you remain our point of contact: we deal with your controller only through you, unless Applicable Data Protection Law or the SCCs require otherwise.
3.2 Details of the processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
3.3 Data we process as a controller
Harbor processes some personal data for its own purposes as a controller, as the Privacy Policy describes. That includes account and sign-in records, billing and subscription records, support correspondence, security and fraud-prevention records, product analytics, and records of visits to our websites. This DPA does not apply to that data. Usage data about the operation, use and performance of the Service is governed by section 4.3 of the Terms of Service.
3.4 Transfers you direct
Some features send Customer Personal Data to destinations that you choose and configure: outbound webhooks and automation calls to endpoints you set up, and the optional AI features, which send data to OpenRouter under your own OpenRouter account as the AI Features Addendum describes. For the AI features, Flowboard writes each request, including its fixed instructions and the workspace names it adds, and chooses the model, while you decide whether any request is sent by saving or removing your key. Those recipients are not our Sub-processors. We send the data on your instruction, and your own arrangements with each recipient govern what it does with the data, including any transfer safeguard the law requires for it.
4. Your instructions
4.1 Processing only on documented instructions
We process Customer Personal Data only on your documented instructions, including with regard to Restricted Transfers, unless European Union or Member State law to which we are subject, or for processing subject to the UK GDPR the law of the United Kingdom, requires us to process it otherwise. In that case we will tell you of that legal requirement before we process, unless that law prohibits telling you on important grounds of public interest. Requests from public authorities under any other law are handled as section 11 describes.
Your instructions are: the Agreement; the processing that you and your Authorized Users initiate through the Service, including through its settings and features; and any other reasonable written instruction that you give us and that we agree in writing. Under those instructions we process Customer Personal Data only to provide, secure, support and maintain the Service for you, and to find and fix problems in it.
4.2 Instructions we believe infringe the law
We will tell you immediately if, in our opinion, an instruction infringes Applicable Data Protection Law. We are not required to carry out that instruction, and we may suspend the affected processing until you confirm, change or withdraw it.
4.3 Your responsibilities
You are responsible for:
- the lawfulness of your instructions and of the Customer Personal Data that you and your Authorized Users put into the Service, including having a lawful basis for it and giving any notices and obtaining any consents that Applicable Data Protection Law requires, for your team members, your clients and the people who use your public forms, booking pages and proposal pages;
- keeping the data that the Acceptable Use Policy prohibits out of the Service, and not using the Service to process special categories of personal data or personal data relating to criminal convictions and offences, other than incidental references that you are entitled to process;
- deciding what each Authorized User can see and do, including what is visible to client users in the client portal; and
- the controls that section 6.3 places with you.
5. Confidentiality of personnel
We give access to Customer Personal Data only to Harbor personnel and contractors who need it to provide, secure, support or maintain the Service, and only to the extent they need it for that work. Each of them is bound by a written obligation of confidentiality, or by an appropriate statutory obligation of confidentiality, that continues after their work for us ends. They work from Pakistan, as section 12.1 states. Contractors provided by Barium Digital (Private) Limited, an affiliated company in Pakistan, work under a Sub-processor agreement that meets section 8.3 and includes Module Three of the SCCs, and that company is listed on the Sub-processors page.
6. Security
6.1 Our measures
We implement and maintain the technical and organizational measures described in Annex II and in the Data Security Standards, to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and to provide a level of security appropriate to the risk as Article 32 of the GDPR requires. By accepting this DPA you confirm that you have reviewed those measures and that, for the Customer Personal Data you put into the Service, they are appropriate.
6.2 Changes to our measures
We may change our measures as technology, threats and the Service change, but we will not materially reduce the overall level of protection they give Customer Personal Data during the term of the Agreement.
6.3 Controls that sit with you
Some security controls are yours to operate: giving each person the role their work needs, removing people who leave, checking what is visible to client users, protecting the API keys, webhook secrets and any OpenRouter key you hold, and securing your team members' sign-in accounts and devices. The Data Security Standards list them. Report a suspected vulnerability or security incident to security@flowboardhq.com.
7. Personal data breaches
7.1 Notice to you
If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and in any event no later than 72 hours after we become aware of it. We send the notice by email to the Owner of each affected workspace, and to any additional security contact you have given us in writing.
7.2 What the notice contains
The notice will describe, to the extent the information is available at the time:
- the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned;
- the likely consequences of the breach;
- the measures we have taken or propose to take to address the breach, including measures to mitigate its possible adverse effects; and
- a contact point from whom you can obtain more information.
Where we cannot give all of this information at once, we will give it in phases without further undue delay, and we will keep you informed of material developments until the breach is resolved.
7.3 Our response
We will take reasonable steps to contain and investigate the breach and to mitigate its effects, record the breach, its effects and the action we took, and give you the reasonable assistance you need to meet your own obligations to notify supervisory authorities and data subjects. You decide whether to make those notifications. We will not notify your data subjects or your clients of a breach affecting Customer Personal Data without your agreement, unless the law requires us to.
7.4 What this section does not cover
A notice under this section is not an acknowledgement of fault or liability by Harbor. This section does not apply to unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked sign-in attempts and denial-of-service attacks that do not lead to unauthorized access.
8. Sub-processors
8.1 General authorization
You give Harbor general written authorization to engage Sub-processors, including those listed on the Sub-processors page on the date you accept this DPA, subject to this section 8.
8.2 The list
The Sub-processors page lists each Sub-processor, what it does for us, the Customer Personal Data it receives and where it processes that data. We keep it current, and it forms Annex III.
8.3 Our obligations for Sub-processors
Before a Sub-processor processes Customer Personal Data, we will review its security and data protection practices, and we will bind it by a written contract to data protection obligations that give Customer Personal Data at least the level of protection this DPA requires, including the obligations in Article 28(3) of the GDPR and, for a Restricted Transfer, an appropriate transfer mechanism. We remain fully responsible to you for each Sub-processor's performance of those obligations.
8.4 Notice of new Sub-processors
We will give you at least 30 days' notice before a new Sub-processor, or a replacement for an existing one, begins to process Customer Personal Data. We give notice by updating the Sub-processors page and by email to the Owner of each workspace and to anyone who has asked to receive these notices by writing to privacy@flowboardhq.com. The notice names the Sub-processor and states its purpose, the Customer Personal Data it will receive and where it will process that data.
8.5 Your right to object
You may object to a new Sub-processor on reasonable grounds relating to the protection of Customer Personal Data, by email to privacy@flowboardhq.com before the notice period ends, stating your grounds. We will then work with you in good faith to resolve the objection, for example by showing how the Sub-processor meets your concern or by changing how the Service processes your data. If we cannot resolve the objection before the notice period ends, you may terminate your subscription to the affected Service by written notice to us, and we will refund, pro rata, the fees you prepaid for the part of your subscription term remaining after termination takes effect. This refund applies despite sections 5.4 and 7.1 of the Terms of Service. If you do not object within the notice period, the new Sub-processor is authorized.
8.6 Urgent replacement
If we must replace a Sub-processor urgently, for reasons outside our reasonable control, to protect the security or continuity of the Service, we will give notice under section 8.4 as soon as we reasonably can, and the objection period in section 8.5 runs for 30 days from that notice.
9. Data subject requests
Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as this is possible, to respond to requests from data subjects to exercise their rights under Applicable Data Protection Law. The Service lets you meet most requests yourself: Authorized Users with the necessary permissions can find, correct and delete records, and the Owner can export a portable copy of your workspace data as CSV and JSON. Where you cannot meet a request through the Service, we will give you reasonable further assistance at no additional charge.
If a data subject sends us a request about Customer Personal Data, we will not respond to it ourselves, other than to tell the person to contact you, and where we can identify you from the request we will pass it to you without undue delay.
10. Impact assessments and prior consultation
Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with any data protection impact assessment, and any prior consultation with a supervisory authority, that Applicable Data Protection Law requires of you in relation to the Service. We will do so first by providing this DPA, the Data Security Standards, the Sub-processors page and written answers to your reasonable questions.
11. Government access requests
Our Government Data Requests policy describes how we handle requests from public authorities for Customer Personal Data. In summary, unless the law prohibits it, we will notify you promptly of a legally binding request for Customer Personal Data, and of any direct access to it by a public authority that we become aware of. We review the lawfulness of each request, challenge a request where there are reasonable grounds to consider it unlawful, and disclose only the minimum data the request requires. Where the SCCs apply, Clause 15 of the SCCs governs, and it prevails over that policy.
12. International transfers
12.1 Where Customer Personal Data is processed
The application servers, primary database and job cache that run the Service are hosted in the European Union, in the Netherlands. Uploaded files and export files are stored by Cloudflare in its Asia-Pacific region. Some Sub-processors process Customer Personal Data in other countries, including the United States, and the Sub-processors page shows where each one processes it. Harbor is a United States company, and the Harbor personnel and contractors who may access Customer Personal Data to provide support and engineering for the Service work from Pakistan. You authorize us to process Customer Personal Data in the United States, in Pakistan and in the countries shown on the Sub-processors page, subject to this section 12.
12.2 Transfers subject to the GDPR
Where the processing of Customer Personal Data under the Agreement involves a Restricted Transfer subject to the GDPR, the Standard Contractual Clauses are incorporated into this DPA by reference and apply between you, as data exporter, and Harbor, as data importer, completed as follows:
| Clause | Selection |
|---|---|
| Modules | Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you are a processor. |
| Clause 7 (docking clause) | Included. |
| Clause 9(a) (use of sub-processors) | Option 2, general written authorization, applies. The time period for prior notice of intended changes is 30 days, as section 8.4 of this DPA sets out. |
| Clause 11(a) (redress) | The optional language is not included. |
| Clause 13 (supervision) | The competent supervisory authority is the authority identified in Annex I.C. |
| Clause 17 (governing law) | Option 1 applies. The SCCs are governed by the law of Ireland. |
| Clause 18(b) (choice of forum and jurisdiction) | The courts of Ireland. |
| Annexes I, II and III | Completed by Annexes I, II and III of this DPA. |
12.3 How this DPA carries out the SCCs
The following sections of this DPA describe how we carry out the corresponding Clauses of the SCCs, and do not limit them: section 4 (instructions, Clause 8.1), section 14 (deletion, return and certification of deletion, Clause 8.5), section 7 (personal data breaches, Clause 8.6), section 13 (documentation and audits, Clause 8.9), section 8 (Sub-processors, Clause 9), section 9 (data subject rights, Clause 10) and section 11 (government access, Clause 15). If any of them conflicts with the SCCs, the SCCs prevail.
12.4 Transfers subject to the UK GDPR
Where a Restricted Transfer is subject to the UK GDPR, the UK Addendum is incorporated into this DPA by reference and applies to the SCCs as section 12.2 completes them. For the tables of the UK Addendum: Table 1 is completed with the details of the parties in Annex I.A; Table 2 is completed with the modules, clauses and options selected in section 12.2; Table 3 is completed by Annexes I, II and III of this DPA; and in Table 4, the party that may end the UK Addendum under its Section 19 is the importer. The competent supervisory authority is the UK Information Commissioner.
12.5 Transfers subject to the Swiss FADP
Where a Restricted Transfer is subject to the Swiss FADP, the SCCs apply as section 12.2 completes them, with these changes: references to the GDPR are read as references to the Swiss FADP to the extent the transfer is subject to it; the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner to the extent the transfer is subject to the Swiss FADP; and the term "Member State" in Clause 18(c) does not prevent data subjects whose habitual residence is in Switzerland from bringing proceedings there. The governing law in Clause 17 and the forum in Clause 18(b) remain as section 12.2 sets out.
12.6 Transfer impact assessments
We will give you the information reasonably available to us that you need to assess the laws and practices of the countries to which Customer Personal Data is transferred, as Clause 14 of the SCCs requires, including information about the locations described in section 12.1.
12.7 Onward transfers to Sub-processors
Before a Sub-processor processes Customer Personal Data in a country that is not recognized as providing an adequate level of protection, we put in place with it a transfer mechanism recognized by Applicable Data Protection Law, such as Module Three of the SCCs.
13. Documentation and audits
13.1 Documentation first
We will make available to you the information necessary to demonstrate our compliance with this DPA and with Article 28 of the GDPR. We do this first through our documentation: this DPA, the Data Security Standards, the Sub-processors page and the records of processing activities we keep as a processor. Flowboard does not hold SOC 2 or ISO 27001 certification, so we do not offer a third-party audit report in place of an audit.
13.2 Written questionnaire
You may send a reasonable written security or data protection questionnaire to privacy@flowboardhq.com, and we will answer it in writing within a reasonable time. We will answer follow-up questions that arise from our answers.
13.3 Audits and inspections
If our documentation and our answers under sections 13.1 and 13.2 are not enough to demonstrate our compliance with this DPA, you may audit that compliance, yourself or through an independent auditor you appoint, including by inspection. An audit is subject to these conditions:
- no more than one audit in any 12-month period, unless there are indications that we are not complying with this DPA, including after a personal data breach affecting your Customer Personal Data, or a supervisory authority requires a further audit;
- at least 30 days' written notice to legal@flowboardhq.com, with a proposed scope, date and duration that we agree in advance, acting reasonably;
- at your cost, including the fees of any auditor you appoint;
- any auditor is bound by written obligations of confidentiality to Harbor and is not a competitor of Harbor;
- the audit takes place during normal business hours, avoids unreasonable disruption to our operations, and gives no access to other customers' data or to information we are bound to keep confidential; and
- the audit does not extend to the facilities or systems of our Sub-processors, whose compliance we will demonstrate with the documentation and reports they make available to us.
Information you obtain in an audit is Harbor's confidential information under section 4.2 of the Terms of Service. You will give us a copy of any audit report, and we will address any failure to comply with this DPA that it identifies.
13.4 Supervisory authorities
This section does not limit an audit or inspection by a competent supervisory authority, or any audit right that the SCCs or Applicable Data Protection Law give you and that cannot be limited by contract.
14. Return and deletion
14.1 Return during your subscription
While your subscription is active, the Owner can export a portable copy of your workspace data as CSV and JSON at any time from Settings. The export lists stored files with links to download them. This export is how we return Customer Personal Data to you.
14.2 After your subscription ends
When your subscription ends for any reason, the Owner has 30 days in which to request an export by email to support@flowboardhq.com. Within the following 30 days, we permanently delete your workspace and the Customer Personal Data in it from the Service, including stored files and export files.
14.3 Deletion by the Owner
If the Owner deletes a workspace in Settings, the deletion is immediate and irreversible, and the workspace cannot be exported afterwards. That deletion is your instruction to delete, and it replaces the export period in section 14.2.
14.4 Backups and logs
Deleted Customer Personal Data may remain in our database backups until those backups age out, which happens within 30 days after the deletion. We do not restore deleted data from backups except to recover the Service after an incident, and if a restore brings back data that had been deleted, we delete it again. Limited Customer Personal Data in operational logs and error reports, such as a recipient email address in an email delivery log, is deleted when those logs expire under our and our Sub-processors' retention settings.
14.5 Data the law requires us to keep
We keep Customer Personal Data beyond the periods above only where the law of the European Union, of a Member State or of another country to which we are subject requires us to store it. We then keep it confidential, process it only for the purpose that law requires, and delete it when the requirement ends.
14.6 Confirmation
On your written request, we will confirm in writing that deletion under this section is complete.
15. California and other US state privacy laws
Where the CCPA or a similar US state privacy law applies to Customer Personal Data, Harbor acts as your service provider or processor under that law, and:
- we process Customer Personal Data only for the business purpose of providing, securing, supporting and maintaining the Service under the Agreement;
- we do not sell or share Customer Personal Data;
- we do not retain, use or disclose Customer Personal Data for any purpose other than that business purpose, including any other commercial purpose, or outside the direct business relationship between you and Harbor, except as the CCPA permits a service provider to do;
- we do not combine Customer Personal Data with personal information that we receive from or on behalf of another person, or that we collect from our own interactions with a consumer, except as the CCPA permits a service provider to do;
- we comply with the obligations that apply to us under the CCPA and provide the same level of privacy protection that the CCPA requires of you;
- you may take reasonable and appropriate steps to ensure that we use Customer Personal Data consistently with your obligations under the CCPA, and, on notice to us, to stop and remediate any unauthorized use of it;
- we will notify you if we determine that we can no longer meet our obligations under the CCPA; and
- we bind our Sub-processors to terms consistent with this section.
Harbor certifies that it understands the restrictions in this section and will comply with them.
16. Liability
Harbor's liability arising out of or relating to this DPA, taken together with its liability under the rest of the Agreement, is subject to the exclusions and the limitation of liability in section 8.3 of the Terms of Service. Those exclusions and that limitation do not apply to the extent the SCCs or Applicable Data Protection Law prohibit them, including to a party's liability to data subjects under Clause 12 of the SCCs.
17. Order of precedence
If documents conflict, they apply in this order, highest first: the SCCs and the UK Addendum, where they apply; this DPA; and the Terms of Service and the other documents that form part of the Agreement.
18. Term, changes and governing law
This DPA takes effect when you accept the Agreement and continues until we have deleted all Customer Personal Data under section 14, even if the Agreement ends before then.
We may update this DPA to reflect changes in the law, in guidance from supervisory authorities or in the Service. We will give at least 30 days' notice, by email to the Owner, before a change that materially reduces your rights or our obligations takes effect, unless the law requires it to take effect sooner. No change reduces the protection the SCCs or the UK Addendum give. The current version is always posted on this page with its last updated date, and superseded versions remain available in the legal archive.
Except for the SCCs and the UK Addendum, which are governed as section 12 sets out, this DPA is governed by the law that governs the Terms of Service, and disputes under it are resolved as section 9 of the Terms of Service provides.
19. Contact
For questions about this DPA or about data protection, email privacy@flowboardhq.com. For legal notices and signed copies, email legal@flowboardhq.com. To report a suspected vulnerability or security incident, email security@flowboardhq.com.
Harbor Software LLC
1309 Coffeen Avenue, STE 1200
Sheridan, Wyoming 82801, USA
Annex I: Details of processing
A. List of parties
| Party | Details |
|---|---|
| Data exporter | The Customer, as identified in its Flowboard account. Contact: the Owner, at the email address on the account. Activities relevant to the transfer: use of the Service under the Agreement. Role: controller (Module Two), or processor acting for its own clients (Module Three). Signature and date: given by accepting the Agreement, on the date of acceptance. |
| Data importer | Harbor Software LLC, a Wyoming limited liability company, which operates Flowboard, of 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA. Contact: privacy@flowboardhq.com. Activities relevant to the transfer: providing the Service under the Agreement. Role: processor (Module Two), or sub-processor (Module Three). Signature and date: given by entering into the Agreement, on the date the Customer accepts it. |
B. Description of the processing and transfer
| Item | Description |
|---|---|
| Categories of data subjects | The Customer's team members. The Customer's clients and their personnel, including client users of the client portal. The Customer's prospects and other contacts recorded in the CRM. People who submit the Customer's public forms, book time through its booking pages, or view or sign its proposals. Any other person whose personal data the Customer or its Authorized Users include in Customer Content. |
| Categories of personal data |
|
| Sensitive data | None intended. Section 4.3 of this DPA and section 2 of the Acceptable Use Policy exclude special categories of personal data and data relating to criminal convictions and offences, other than incidental references the Customer is entitled to process, and the Acceptable Use Policy also prohibits health records, biometric identifiers, full government identity numbers, payment card data and access credentials. |
| Frequency of the transfer | Continuous, for the duration of the Agreement. |
| Nature of the processing | Hosting and storage, organization, retrieval, display, transmission (including email notifications and delivery through the client portal), export and deletion of Customer Personal Data as the Service requires, and the support, maintenance and security of the Service, including access by Harbor personnel and contractors to investigate and resolve problems. |
| Purpose of the processing | To provide the Service to the Customer under the Agreement, including support, security and maintenance. |
| Retention | For the term of the Agreement. After the subscription ends: 30 days in which to request an export, then deletion within the following 30 days, with backups aging out within 30 days after deletion, as section 14 sets out. Deletion by the Owner in Settings is immediate. |
| Locations of processing | Application servers, primary database and job cache: the Netherlands (European Union). Stored files and export files: Cloudflare's Asia-Pacific region. Sub-processors: the locations shown on the Sub-processors page, which include the United States and Pakistan. Access by Harbor personnel and contractors for support and engineering: Pakistan. |
| Transfers to Sub-processors | The subject matter, nature and duration of processing by each Sub-processor are shown on the Sub-processors page, for the duration of the Agreement. |
C. Competent supervisory authority
For transfers subject to the GDPR, the competent supervisory authority is determined under Clause 13(a) of the SCCs:
- where the Customer is established in an EU Member State, the supervisory authority responsible for ensuring the Customer's compliance with the GDPR as regards the transfer;
- where the Customer is not established in an EU Member State but falls within Article 3(2) of the GDPR and has appointed a representative under Article 27(1) of the GDPR, the supervisory authority of the Member State in which that representative is established; and
- where the Customer is not established in an EU Member State and falls within Article 3(2) of the GDPR without having to appoint a representative, the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred, in relation to the offering of goods or services to them or the monitoring of their behavior, are located.
For transfers subject to the UK GDPR, it is the UK Information Commissioner. For transfers subject to the Swiss FADP, it is the Swiss Federal Data Protection and Information Commissioner.
Annex II: Technical and organizational measures
This Annex summarizes the measures Harbor applies to Customer Personal Data. The Data Security Standards describe them in more detail. Where a measure depends on a provider rather than on Flowboard's own systems, the Sub-processors page names that provider.
| Measure | What Harbor does |
|---|---|
| Encryption of data in transit | The web application is served over HTTPS with a Strict-Transport-Security header set for two years, covering subdomains and eligible for browser preload lists. TLS connections are terminated by our frontend hosting and edge network providers. |
| Protection of stored credentials | Client portal passwords are stored as bcrypt hashes. Portal session tokens and Flowboard API keys are stored as SHA-256 hashes. A workspace's OpenRouter key is encrypted at the application level with a key held separately in our hosting configuration, and is not returned to the browser after it is saved. Team member passwords are held by our authentication provider, not by Flowboard. Payment card numbers are entered on pages hosted by the payment provider and never reach Flowboard. |
| User identification and authentication | Team member sign-in is provided by our authentication provider, and the application verifies each session token against the provider's published signing keys. Every route that is not public requires a valid session. Client users have a separate identity store and sign in with a password or with an emailed magic link valid for 24 hours, limited to five requests per hour for each email address. Portal sessions last up to 30 days. |
| Access control and authorization | Each workspace has five roles (Owner, Admin, Manager, Member and Viewer) and a configurable set of permissions. Financial data, including cost rates, is controlled by a permission that Owners and Admins hold by default. The client portal shows a client user only the tasks and comments the workspace marks as visible to clients. |
| Separation of customers | All workspaces share one multi-tenant database. Isolation is enforced in the application: each workspace API route checks that the caller is a member of the workspace and scopes its queries to that workspace. |
| Access by Harbor personnel | Access is limited to personnel and contractors who need it, under confidentiality obligations (section 5). The administrative console is restricted by allow-lists enforced in both the web application and the API, and its actions are recorded in an administrative audit log with the acting administrator and their IP address. Its impersonation action records an audit entry and does not create a session as the user. |
| Event logging and monitoring | The workspace audit log records creation, update, deletion, status changes and visibility changes for tasks, task dependencies, comments, time entries, invoices, expenses, workspace settings and message threads, and Owners and Admins can read it. The API writes structured request logs, backend errors are reported to an error monitoring service, an automated health check tests the API every 15 minutes, and the status page reports service status. |
| Integrity of data exchanges | Inbound webhooks from our authentication and payment providers are verified by signature, inbound automation webhooks are verified with HMAC, and outbound webhooks are signed with HMAC-SHA256. |
| Secure development and configuration | The continuous integration pipeline runs static security analysis of the backend code and fails on high-severity findings, and checks dependencies. The web application sends security headers, including a Content Security Policy. Workspace API requests are rate limited. |
| Availability and restoration | The production database is backed up automatically every day, with daily backups retained for 7 days and weekly backups retained for 28 days. Restore steps are documented and have been tested by restoring to a staging environment. We target 99.9% uptime, as a target and not a guarantee. |
| Incident response | A written incident response procedure covers triage, containment, notification of affected customers under section 7 of this DPA, and a record of each incident. |
| Vulnerability reporting | Security reports go to security@flowboardhq.com, which is published in a security.txt file on the application and marketing domains. |
| Data minimization | The AI features are off until a workspace adds its own key. The text of AI search and compose requests is not written to our logs. Workspace exports exclude secrets such as API key hashes, webhook secrets, access tokens and authentication data. |
| Limited retention and erasure | Records deleted in the application are permanently removed from the primary database 30 days after deletion. Workspace data is deleted after the subscription ends, and backups age out, as section 14 of this DPA sets out. |
| Data portability | The Owner can export workspace data as CSV and JSON, with a manifest of stored files and download links valid for 7 days. |
| Physical security | Harbor operates no data centers of its own. The physical security of the facilities that host the Service is provided by our hosting Sub-processors. |
| Sub-processor management | Sub-processors are reviewed and bound by written data protection terms before they receive Customer Personal Data, and changes are notified as section 8 of this DPA sets out. |
| Certification and assurance | Flowboard holds no SOC 2 or ISO 27001 certification. Compliance is demonstrated through documentation, written questionnaires and audits under section 13 of this DPA. |
| Assistance to the Customer | Harbor assists the Customer with data subject requests, breach notifications and impact assessments as sections 7, 9 and 10 of this DPA set out. |
Annex III: Sub-processors
Harbor uses Sub-processors under the general written authorization in section 8.1 (Clause 9(a), Option 2, of the SCCs). The current list, showing each Sub-processor's purpose, the Customer Personal Data it receives and where it processes that data, is on the Sub-processors page and forms this Annex III. OpenRouter and the model providers used by the optional AI features are engaged by the Customer directly, as section 3.4 describes, and are not Sub-processors.