Version v1 · Last updated: 29 June 2026
This page transparently lists every external service flintery uses — separated by whether they process your clients' contract data or only concern your own master data. It is the living list referenced in our data processing agreement (DPA § 6).
These services process contract data (the end-client and project data you enter). They are part of the DPA (Annex 2).
| Service | Location | Purpose | Third country | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Nürnberg, DE | Application hosting, PostgreSQL database, Redis, backups, audit-proof archive PDFs | No | ISO 27001; processing within Germany |
| Cloudflare, Inc. (US) / Cloudflare London, LLC (UK) | US / UK | CDN, WAF, DDoS protection, TLS termination, reverse proxy — pass-through of traffic “in transit” | Yes | UK adequacy decision; EU-US Data Privacy Framework (US entity); Standard Contractual Clauses (SCCs) |
These services concern only your own master, payment or tracking data (the controller's sphere). They are not part of the DPA and are listed here for transparency only.
| Service | Location | Purpose | Third country | Safeguards |
|---|---|---|---|---|
| Stripe | IE / US | Subscription payment, billing | Yes | EU-US DPF; SCCs |
| Resend | US | Transactional emails (account, verification, notices) | Yes | SCCs |
| Brevo (Sendinblue) | FR | Newsletter / lifecycle emails | No | — |
| Cookiebot (Usercentrics) | DK | Consent management | No | — |
| Sentry | US (Server EU) | Error tracking (minimal PII) | Yes | EU-US DPF; SCCs |
| PostHog | EU-Cloud (FFM) | Product analytics | No | — |
| Google Analytics 4 | IE / US | Web analytics | Yes | EU-US DPF; SCCs |
| Google Ads | IE | Conversion / remarketing | Yes | EU-US DPF; SCCs |
| Meta | IE / US | Pixel + Conversions API | Yes | EU-US DPF; SCCs |
| FirstPromoter | RO (Hosting US) | Affiliate tracking | Yes | EU-US DPF; SCCs |
| BANKSapi | DE | Bank sync (admin-gated) | No | — |
| sevDesk / lexoffice | DE | Accounting export (user-initiated) | No | — |
When adding or replacing a sub-processor we notify you in advance with 30 days' notice to the contact email on file. You may object to the change within 14 days of receipt for important data-protection reasons (channel: legal@flintery.com).
A traceable history of all changes to this list.
| Version | Date | Change |
|---|---|---|
| v1 | 29 Jun 2026 | Initial publication of the sub-processor list. |