Last updated 2026-06-25 · Referenced by our Data Processing Addendum
This page lists the third parties ("sub-processors") that may process customer data on Flow AI's behalf, and the Upstream AI Providers that perform inference on the requests you route. We update this list before adding a new sub-processor that handles customer data, and give DPA customers at least 30 days' notice of material changes — email legal@flowaiapi.com to subscribe to change notifications.
| Sub-processor | Purpose | Region | Data processed |
|---|---|---|---|
| Stripe | Payments & billing | USA / global | Card payments, subscriptions, invoices. We never store card numbers. |
| Clerk | Authentication | USA | Sign-in, identity, and session management (email + auth). |
| Railway | Hosting & database | Singapore | Application hosting, Postgres database, Redis cache. |
| Cloudflare | Edge / CDN / DNS | Global | TLS termination, edge routing, and DNS for flowaiapi.com. |
| PostHog (US Cloud) | Product analytics | USA | Aggregate product analytics. No prompt/response content or PII is sent — business metadata only. |
| AgentMail | Transactional email | USA | Sends account email (receipts, trial and billing notices) from support@flowaiapi.com. |
When you make a request, it is forwarded to the selected Upstream Provider to perform inference. The provider receives your prompt and request metadata under its own terms and privacy policy. You can pin a provider/model or restrict routing at any time.
| Provider | Region | Role |
|---|---|---|
| DeepSeek | Outside Singapore | Inference for requests routed to DeepSeek models, under DeepSeek's terms & privacy policy. |
| MiniMax | Outside Singapore | Inference for requests routed to MiniMax models, under MiniMax's terms & privacy policy. |
Upstream Providers may process your request outside Singapore. If you require that certain content never be processed by a specific provider or region, pin an allowed provider or enable "trusted sellers only" in your dashboard.
Eligible non-sensitive, latency-tolerant requests may be served by independent third-party operators running open-source models on their own machines, in exchange for credits. Operators are verified and reputation-scored but are not employees or agents of Flow AI, and they are treated as a disclosed category of sub-processor. Requests flagged as containing secrets or PII — and any account set to "trusted sellers only" — are never dispatched to operators; such traffic is served only by first-party Upstream Providers or your own connected keys. Every response shows who served it (served_by) and whether it was flagged. See Trust & security and the Data & Training Policy.