Version v1.2 · Last updated: 9 October 2026
This page lists the sub-processors flintery uses to process your clients’ data on your behalf (Art. 28 GDPR). Services that only concern your own account, payment or usage data are listed in the privacy policy.
These services process contract data (the end-client and project data you enter). They are part of the DPA (Annex 2).
| Service | Location | Purpose | Third country | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Nürnberg, DE | Application hosting, PostgreSQL database, Redis, backups, audit-proof archive PDFs | No | ISO 27001; processing within Germany |
| Cloudflare, Inc. (US) / Cloudflare London, LLC (UK) | US / UK | CDN, WAF, DDoS protection, TLS termination, reverse proxy — pass-through of traffic “in transit” | Yes | UK adequacy decision; EU-US Data Privacy Framework (US entity); Standard Contractual Clauses (SCCs) |
| Mistral AI SAS | Paris, FR | Reading receipts during import (PDF, scan, photo); processing within the European Economic Area | Yes | Access by service providers from third countries only on the basis of adequacy decisions or Standard Contractual Clauses (SCCs); no training on the data; deletion after 30 days at the latest |
Services that only concern your own account, payment or usage data (such as payment processing, email delivery or analytics) are not part of the data processing agreement. They are fully listed in the privacy policy.
When a sub-processor is added or replaced, we enter the change in this list beforehand. You may object to the change within 14 days of the entry for important data protection reasons (legal@flintery.com). If you do not object within this period, the change is deemed approved. In urgent security or outage cases we may switch immediately and will enter the change without undue delay afterwards. If you activate an optional feature after being informed about the service it uses, this constitutes a separate authorisation; the period does not apply in that case.
A traceable history of all changes to this list.
| Version | Date | Change |
|---|---|---|
| v1.2 | 9 Oct 2026 | Added Mistral AI SAS: reading receipts during import (PDF, scan, photo). |
| v1.1 | 18 Jul 2026 | List focused on the sub-processors relevant to the DPA. Services that only concern account, payment or usage data (controller sphere) are fully listed in the privacy policy. No change to the sub-processors in use. |
| v1 | 29 Jun 2026 | Initial publication of the sub-processor list. |