This register identifies suppliers that may process customer personal data for LinesFlow. A provider is used only when the relevant feature is configured. Customer-selected Sage, Xero, and QuickBooks connections are third-party accounting services chosen by the customer and are addressed separately in the Terms.
| Provider | Function | Location | Transfer control |
|---|---|---|---|
| Render | API hosting and scheduled jobs | United States (Oregon, US West) | UK Addendum to the EU SCCs, or the UK Extension to the EU-US Data Privacy Framework where the supplier is certified |
| Supabase | Managed PostgreSQL infrastructure | European Union (Frankfurt, eu-central-1) | UK adequacy regulations for the EEA |
| Vercel | Web application delivery and API request routing — application traffic, including uploaded documents, passes through Vercel in transit | United States (primary processing), with processing in countries where Vercel and its listed sub-processors operate | EU SCCs plus the UK International Data Transfer Addendum (Vercel DPA; plan eligibility applies) |
| Resend | Transactional and inbound email | United States (primary processing and listed sub-processors) | UK Extension to the EU-US Data Privacy Framework while Resend remains actively certified; UK Addendum to the EU SCCs as the contractual fallback |
| Stripe | Subscription billing and usage metering | United States (Stripe LLC) and Stripe affiliates and sub-processors in other listed jurisdictions | UK Extension to the EU-US Data Privacy Framework while Stripe, LLC remains actively certified; UK International Data Transfer Addendum as the contractual fallback |
| Account authentication | United States and other countries where Google operates servers | UK Extension to the EU-US Data Privacy Framework while Google LLC remains actively certified; SCCs where a transfer is not covered by adequacy | |
| OpenAI | AI-assisted document extraction | United States, with API infrastructure processing in OpenAI's published sub-processor locations; no regional residency is configured | EU SCCs amended by the UK Addendum under the OpenAI DPA |
| DeepSeek (optional) | Alternative AI extraction only when explicitly enabled | Must be confirmed before activation | Must not be enabled until transfer and supplier assessments are approved |
Supplier records
The locations and safeguards above reflect the service configuration used by LinesFlow and the suppliers’ published terms. Supporting records: Vercel DPA, Resend DPA and sub-processor list, Stripe DPA and Data Transfers Addendum, Google transfer frameworks, and the OpenAI DPA and sub-processor list. These records are reviewed when a supplier, plan, hosting region, or transfer mechanism changes.
DPF status was checked against the U.S. Department of Commerce participant list on 31 July 2026: Resend (participant 8907), Stripe, LLC (participant 10014), and Google LLC (participant 5780). Resend was active with re-certification under review; Stripe and Google were active. Contractual fallback safeguards remain recorded above because certification status can change.
Change notices
We aim to notify account owners by email at least 15 days before a new material sub-processor begins processing customer data, except where urgent security or legal circumstances make advance notice impracticable. Objections based on reasonable data-protection grounds may be sent to privacy@linesflow.com.