A subprocessor is a third party that processes customer personal data on FlowForma's behalf to provide a FlowForma product. This page lists the current subprocessors for each product, as referred to in our Data Processing Agreement.
1. FlowForma Process Automation
Process and form data stays in your own Microsoft 365 tenant, under your agreement with Microsoft, so Microsoft is not FlowForma's subprocessor for that data. The subprocessors below process platform data and AI requests.
| Subprocessor | What it does and the data it processes | Location |
|---|---|---|
| Microsoft | Microsoft Azure hosting for FlowForma's platform: licensing, configuration and platform data. | The region you choose: Europe, Asia-Pacific, India or the Americas |
| Microsoft | Azure OpenAI Service: built-in AI features, using the content you send to them. | Microsoft Azure. Standard abuse monitoring may keep prompts and outputs for up to 30 days |
If you connect your own AI provider, that provider works under your own agreement with it and is not FlowForma's subprocessor.
2. FlowForma Contract, FlowForma Agent Trust and FlowForma Assure
These products are hosted on Microsoft Azure, with stored data in the European Economic Area.
| Subprocessor | What it does and the data it processes | Location |
|---|---|---|
| Microsoft | Azure hosting (Container Apps, SQL Database, Blob Storage, Service Bus, Key Vault, Container Registry): application runtime, database, file storage and job queues. Processes the customer data held in the service. | North Europe (Ireland), with database backups and file replicas in West Europe (the Netherlands) |
| Microsoft | Microsoft Defender for Storage: malware scanning of uploaded files. | Microsoft Azure |
| Microsoft | Azure OpenAI Service: AI analysis and embeddings, using extracted document text, questionnaire responses, comments and control text. | Resource and stored data in Sweden Central. Global deployment may process individual requests in any Azure region. Standard abuse monitoring may keep prompts and outputs for up to 30 days |
| Microsoft | Azure AI Search: search and retrieval, using extracted document text and embeddings. | North Europe (Ireland) |
| Microsoft | Azure Communication Services: service emails, invitations and one-time passcodes. | Europe |
| Microsoft | Application Insights and Log Analytics: monitoring, diagnostics and operational telemetry. | North Europe (Ireland) |
| Microsoft | Azure Front Door with web application firewall: edge routing, TLS and firewall processing. | Global edge, with firewall logs in West Europe (the Netherlands) |
| Microsoft | Microsoft Entra ID and Microsoft Graph: sign-in and identity processing. | Microsoft global service |
| Google Workspace sign-in, where your organization chooses it. | Google global service | |
| Amplitude | Product analytics and in-product guidance, using usage data. No session replay. | EU data region |
| LevelBlue | Security monitoring (SIEM) of relevant security events at the service edge. | Security events exported from Microsoft Azure West Europe (the Netherlands) |
3. Services that are not subprocessors
- Your own Microsoft 365 tenant, Microsoft Entra ID tenant or Google Workspace environment. You choose and control these.
- GitHub, which hosts FlowForma's source code and build pipelines and does not receive customer data.
- Document-processing libraries that run inside FlowForma's own services and do not send customer data to outside services.
- HubSpot, which FlowForma uses for free trial registrations and marketing, as described in our Privacy Statement. It does not receive customer data from the products.
4. Changes to subprocessors
FlowForma may add or replace subprocessors as our products develop. We will keep this page up to date and give notice of material changes, as set out in the Data Processing Agreement. You may object to a change on reasonable data protection grounds.
To be told about changes, email info@flowforma.com with the subject "Subprocessor updates".