Sub-processors
FlowSign uses the third-party service providers listed below to run the service. Each is bound by written agreement to protect the personal information we entrust to them at a standard comparable to the New Zealand Privacy Act 2020, and each is subject to a recognised privacy or data-protection framework in its home jurisdiction.
Read this page together with our Privacy Policy and, for business customers, our Data Processing Addendum.
Core infrastructure
Providers that host FlowSign or handle the documents and data behind it.
| Provider | Purpose | Jurisdiction | Transfer basis (IPP 12) |
|---|---|---|---|
| Supabase (opens in a new tab) | Managed Postgres database, file storage for uploaded and signed PDFs, and authentication | United States (data hosted in AWS ap-southeast-1, Singapore) | IPP 12(1)(f) - subject to written contractual protections comparable to the Privacy Act 2020 |
| Railway (opens in a new tab) | Application hosting for the FlowSign web apps and background workers | United States (application deployment region: Singapore, ap-southeast-1) | IPP 12(1)(f) - subject to written contractual protections comparable to the Privacy Act 2020 |
Operational providers
Providers that support billing, communications and reliability.
| Provider | Purpose | Jurisdiction | Transfer basis (IPP 12) |
|---|---|---|---|
| Stripe Payments New Zealand Limited (opens in a new tab) | Subscription billing, payment processing, and payment-method storage | New Zealand (with Stripe, Inc. in the United States as processor) | Domestic collection by the NZ entity; onward transfer to Stripe, Inc. relies on IPP 12(1)(f) and Stripe's binding intra-group data-protection framework |
| Resend (opens in a new tab) | Transactional email delivery - signing invitations, reminders, receipts, security notices | United States | IPP 12(1)(f) - subject to written contractual protections |
| Sentry (opens in a new tab) | Application error monitoring and crash reporting | United States | IPP 12(1)(f) - subject to written contractual protections |
Notification of changes
This list will change from time to time as FlowSign evolves. We update this page whenever a sub-processor is added, removed, or replaced. Business customers under a Data Processing Addendum are notified by email at least 30 days in advance of a new sub-processor that will handle their data. To set or change the address we notify, email legal@flowsign.app.
Questions
If you have questions about a specific sub-processor or the safeguards in place, contact our Privacy Officer at privacy@flowsign.app.