Sub-processors

Last updated: September 24, 2026

1. About this page

This page lists the service providers that Harbor Software LLC ("we" or "us"), which operates Flowboard, uses to process personal data for the Service, and the integrations that customers can turn on. The Data Processing Addendum (the "DPA") refers to this page for its list of sub-processors. "Customer" means the business that accepted the Terms of Service. "Customer Personal Data" means the personal data we process on a Customer's behalf under the DPA, as the DPA defines it, which is mainly the personal data in what a Customer, its team members and its client users put into the Service. Other capitalized terms have the meaning given in the DPA.

2. What a sub-processor is

A sub-processor is a third party that we engage to process Customer Personal Data on our behalf so that we can provide the Service. For example, our hosting provider stores the Flowboard database, and our email provider delivers the invitations and notifications the Service sends. We remain responsible to each Customer, under the DPA, for how our sub-processors process Customer Personal Data.

3. How we choose and bind sub-processors

• Review before we engage. Before a provider processes Customer Personal Data, we review its security and privacy practices, where it processes data, and whether it can meet the obligations in the DPA.
• A written agreement. Each sub-processor is bound by a written agreement, usually its data processing agreement, with data protection obligations that protect Customer Personal Data at least as well as the DPA does. These cover confidentiality, security, assistance with requests, deletion at the end of the service and, where needed, safeguards for international transfers.
• Only the data it needs. Each sub-processor receives only the Customer Personal Data it needs for its function. We configure our services to limit what each one receives, and a sub-processor may not use Customer Personal Data for its own purposes.
• Ongoing review. We review this list when we add a provider, when a provider changes how or where it processes data, and when we change what we send to it.

4. The two lists on this page

4.1 Service sub-processors

The first list below shows the sub-processors we have chosen to help run the Service. For each one it shows the legal entity, what it does for Flowboard, the data it receives and where it processes that data. Some process all Customer Content, such as the provider that hosts the database. Others receive only a narrow part, such as the provider that sends email.

4.2 Customer-enabled integrations

The second list below shows integrations that process data only when a Customer or one of its team members turns them on, and only at the Customer's direction. They are the AI features, which run on the Customer's own OpenRouter account and send requests that Flowboard writes to the model that Flowboard chooses; the browser push services that deliver notifications a team member switches on in their own browser; and the webhook endpoints a Customer configures. While they run on the Customer's own account, browser or endpoint, these recipients are not our sub-processors, and their own terms govern the data they receive. We list them so that Customers can see what data leaves the Service when each one is on. The AI Features Addendum describes the AI features in full.

5. Locations and transfer safeguards

The location shown for each provider is where it processes the data, or where it is established when it processes data in more than one place. The Flowboard database, the background jobs that work on it and the cache run in the Netherlands, in the European Union. Cloudflare stores uploaded files and export archives in its Asia-Pacific region. Several of our sub-processors are established in the United States, and some operate global networks. Our own personnel and contractors who operate and support the Service work from Pakistan, and can access Customer Personal Data from there where their role requires it, under confidentiality obligations. Our contractors are provided by Barium Digital (Private) Limited, an affiliated company in Pakistan, which is listed below as a sub-processor, and our agreement with it includes Module Three of the Standard Contractual Clauses.

Where a sub-processor processes Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland in a country that has not been found to provide an adequate level of protection, our agreement with it includes the Standard Contractual Clauses approved by the European Commission, with the UK International Data Transfer Addendum for data from the United Kingdom and the changes Swiss law requires for data from Switzerland. The DPA includes the same safeguards between each Customer and us. You can ask for a copy at privacy@flowboardhq.com.

6. Notice of new sub-processors

At least 30 days before a new sub-processor begins to process Customer Personal Data, whether it is added or replaces an existing one, we will:

• update this page to show the new sub-processor, what it will do, the data it will receive, its location and the date it will begin; and
• email the Owners of every workspace and everyone who has subscribed to sub-processor updates.

The 30-day period runs from the date we send that email. To subscribe, email privacy@flowboardhq.com with the subject "Sub-processor updates", and send the same subject with the word "Unsubscribe" to stop. We record every change in the change log in section 8, including changes that need no advance notice, such as removing a sub-processor or correcting a description.

7. Objecting to a new sub-processor

A Customer may object to a new sub-processor on reasonable grounds relating to the protection of personal data. Send the objection to privacy@flowboardhq.com before the notice period ends, and explain the concern. We will work with the Customer in good faith to address it, for example by explaining the safeguards in place or by changing how the Service is configured for that Customer. If we cannot resolve the objection, the DPA sets out the Customer's remedies.

8. Change log

• September 24, 2026: list published as a standalone page; added Railway, Resend, Sentry, PostHog, Google Workspace and Barium Digital (Private) Limited; added Cloudflare's role as the network edge for the Flowboard API and the Asia-Pacific location of stored files; corrected the Vercel role to front-end hosting.