Version v1.1 · Last updated: 18 July 2026
This page lists the sub-processors flintery uses to process your clients’ data on your behalf (Art. 28 GDPR). Services that only concern your own account, payment or usage data are listed in the privacy policy.
These services process contract data (the end-client and project data you enter). They are part of the DPA (Annex 2).
| Service | Location | Purpose | Third country | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Nürnberg, DE | Application hosting, PostgreSQL database, Redis, backups, audit-proof archive PDFs | No | ISO 27001; processing within Germany |
| Cloudflare, Inc. (US) / Cloudflare London, LLC (UK) | US / UK | CDN, WAF, DDoS protection, TLS termination, reverse proxy — pass-through of traffic “in transit” | Yes | UK adequacy decision; EU-US Data Privacy Framework (US entity); Standard Contractual Clauses (SCCs) |
Services that only concern your own account, payment or usage data (such as payment processing, email delivery or analytics) are not part of the data processing agreement. They are fully listed in the privacy policy.
When adding or replacing a sub-processor, we notify you in advance with a lead time of 7 days via your registered contact email. You may object to the change within 14 days of receipt for important data protection reasons (channel: legal@flintery.com); this period continues to run after the change takes effect. If you do not object within the period, the change is deemed approved. In urgent security or outage cases we may switch immediately and will inform you without undue delay afterwards. If you activate an optional feature after being informed about the service it uses, this constitutes a separate authorisation; the notice periods do not apply in that case.
A traceable history of all changes to this list.
| Version | Date | Change |
|---|---|---|
| v1.1 | 18 Jul 2026 | List focused on the sub-processors relevant to the DPA. Services that only concern account, payment or usage data (controller sphere) are fully listed in the privacy policy. No change to the sub-processors in use. |
| v1 | 29 Jun 2026 | Initial publication of the sub-processor list. |