NexFlow uses the following sub-processors to deliver the service. Where required, each has a Data Processing Agreement and international-transfer safeguards in place. Changes to this list are announced 30 days in advance for customers on Flow or Fleet plans.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Stripe | Payment processing (cards, ACH, BPAY) | United States |
| PayPal | Payment processing (PayPal balance and hosted checkout) | Global / United States |
| Coinbase Commerce | Cryptocurrency payment processing | United States |
| AI model providers | Public AI concierge and agreed client workflow processing, depending on the selected deployment/provider | United States |
| n8n Cloud | Workflow execution and AI-agent orchestration for client projects, when not self-hosted | Europe (Frankfurt) / global infrastructure |
| Cloudflare | CDN, WAF, R2 object storage, DDoS protection, Turnstile bot checks | Global (nearest edge) |
| Notion | Internal project management and lead tracking | United States |
| Slack | Booking notifications and internal communication | United States |
| Google Workspace | Email, document collaboration, calendar | Global (multi-region) |
Additional infrastructure
The following services are used for infrastructure and do not process customer content directly:
- Neon — Postgres hosting (Sydney, ap-southeast-2)
- AWS — KMS encryption key management, S3 backups (Sydney, ap-southeast-2)
- Vercel — Portal application hosting (global edge)
- Upstash — Redis for rate limiting and job queues (ap-southeast-2)
- Postmark — Transactional email delivery (United States)
- Sentry — Error monitoring (PII scrubbed before send; United States)
- PostHog — Product analytics (self-hosted; ap-southeast-2)
Changes to this list
We update this page when sub-processors are added or removed. Customers on Flow or Fleet plans receive 30 days' advance notice of material changes via email to the billing contact. Customers on Spark can monitor this page or subscribe to RSS from our Field Notes.
Contact
Questions about sub-processors or data processing: privacy@nex-flow.io