Skip to Content
ComplianceSub-processors

Sub-processors

FlowState uses the following sub-processors to deliver the service (Article 28 GDPR).

Amazon Web Services (Amazon Web Services EMEA SARL)

Purpose: hosting of the whole service: compute, database, file storage, encryption keys, credentials, email sending, sign-in, logs and monitoring.

Data processed: all FlowState data: deal data, user profiles, audit logs, credentials and email notifications.

Region: eu-central-1 (Frankfurt) for all stored data and the service itself. Two parts run in us-east-1 (N. Virginia) because AWS offers them only there:

  • the component that receives events from AWS Partner Central processes them and stores the result in eu-central-1. It keeps no records in us-east-1. Events wait in an encrypted queue there until they are processed; an event that fails processing stays in that queue for up to 14 days. The component’s operational logs are also kept in us-east-1;
  • usage reports for AWS Marketplace billing contain only usage amounts, no deal data.

DPA: AWS GDPR Data Processing Addendum 

Amazon Bedrock (Anthropic’s Claude models)

Purpose: AI analysis: deal summaries, stalled-deal recommendations, win/loss analysis, business-problem drafts and field suggestions.

Data processed: deal data such as the deal name, stage, close date, amount, owner and a summary of recent activities. Contact details are not sent.

Region: FlowState sends each request from eu-central-1 (Frankfurt, Germany). AWS processes it in one of six European AWS regions: Frankfurt (eu-central-1), Stockholm (eu-north-1), Milan (eu-south-1), Spain (eu-south-2), Ireland (eu-west-1) or Paris (eu-west-3). Requests are not sent to AWS regions outside Europe. The results are stored in eu-central-1 (Frankfurt, Germany).

How: FlowState calls Anthropic’s Claude models directly through the Amazon Bedrock Converse API, not through Anthropic’s own API. Amazon Bedrock’s terms, which are part of the AWS DPA, apply. Data sent to Amazon Bedrock is not used to train models.

Stripe (Stripe Payments Europe, Ltd.)

Purpose: payment, subscription and invoicing for organisations that pay through Stripe.

Data processed: the billing details entered on the Stripe payment page: the billing contact’s name, the company name, email address, phone number, billing address and payment method. Stripe stores these; FlowState stores only the Stripe customer and subscription IDs.

Organisations that pay through AWS Marketplace or by invoice do not use Stripe.

DPA: Stripe Data Processing Agreement 

AWS Marketplace (Amazon Web Services, Inc.)

Purpose: billing for organisations that subscribe through AWS Marketplace.

Data processed: the AWS customer identifier, the AWS account ID, the subscription status and the usage amounts FlowState reports.

Google LLC

Purpose: Sign in with Google, for people who choose it.

Data processed: the sign-in itself, and the email address and name that Google returns to FlowState.

HubSpot (HubSpot Ireland Limited)

Purpose: the CRM integration. FlowState accesses each tenant’s own HubSpot portal on the tenant’s behalf, with the access the tenant granted.

Data processed: deals, their activities, and the contacts and companies associated with them (contacts: name and job title). FlowState writes the APN properties, notes on the deal timeline, the AWS team as contacts, and company links back to the portal.

Region: the region of the tenant’s HubSpot account.

Slack Technologies, LLC

Purpose: optional deal alerts, for tenants that connect Slack. The tenant connects its own Slack app in its own Slack workspace.

Data processed: FlowState looks up people in the workspace by email address, and posts deal alerts — deal names, amounts, owners, close dates and activity gaps — as direct messages or to a channel the tenant chooses. It also sends a connection-test message and a message when the first HubSpot sync finishes.

AWS Partner Central and AWS Marketplace (seller)

When a tenant connects APN, FlowState writes co-sell opportunities into the tenant’s own AWS Partner Central account and reads AWS’s changes back. When a tenant connects AWS Marketplace, FlowState creates and manages private offers in the tenant’s own Marketplace seller account. In both cases FlowState acts through an IAM role in the tenant’s own AWS account, which the tenant can remove at any time.

Changes to this list

FlowState updates this page when a sub-processor is added or removed. Clients who have signed a DPA with FlowState are told about material changes at least 30 days in advance.

GDPR