Legal
Sub-processors
The third-party service providers (sub-processors) Floxa Ltd uses to deliver the service, what each one does for us, and where they process data.
Last updated: 2 September 2026
Floxa Ltd ("Floxa") uses the third-party service providers listed below as sub-processors to deliver the Floxa service. A sub-processor is a third party engaged by Floxa that may process personal data our customers store in Floxa ("Customer Data") on our behalf. This page is maintained as the authoritative list of sub-processors referred to in our Data Processing Agreement.
Before engaging any sub-processor, we assess its security and data protection practices and put a written agreement in place that imposes data protection obligations consistent with our Data Processing Agreement and UK GDPR Article 28.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services Amazon Web Services EMEA SARL | Database hosting (Amazon RDS for PostgreSQL) | All Customer Data stored in Floxa | United Kingdom (London, eu-west-2) |
| Vercel Vercel Inc. | Application hosting and serverless compute | All Customer Data processed by the application | United States (global edge network) |
| Cloudflare Cloudflare, Inc. | Object storage (Cloudflare R2) for uploaded files | Files uploaded to Floxa — logos, receipts, attachments | European Union (EU jurisdiction storage) |
| Stripe Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing for Floxa plans; card payments on customer invoices (Stripe Connect) | Billing contact details, transaction data, connected-account onboarding information | European Union / United States |
| Mailgun Sinch Email (Mailgun Technologies, Inc.) | Transactional email delivery — invoices, timesheets, account emails | Recipient names, email addresses, email content | European Union (EU sending region) |
| Google Google Ireland Limited / Google LLC | Optional “Sign in with Google” authentication | Name and email address of users who choose Google sign-in | European Union / United States |
International transfers
Customer Data is stored in the United Kingdom and the European Union: our database runs in AWS's London region, uploaded files are held in EU-jurisdiction storage, and transactional email is sent from Mailgun's EU region. Where a sub-processor processes personal data outside the UK or EEA (for example Vercel, Stripe or Google in the United States), the transfer is protected by a lawful transfer mechanism — the UK Extension to the EU–US Data Privacy Framework, and/or Standard Contractual Clauses with the UK International Data Transfer Addendum, as set out in that provider's data processing terms.
Services acting as independent controllers
Some providers also process personal data for their own purposes as independent controllers rather than on our instructions. In particular, Stripe acts as an independent controller for payment processing, fraud prevention and its own regulatory compliance, and Google acts as an independent controller when you choose to sign in with a Google account. Their own privacy notices apply to that processing.
Changes to this list
When we plan to add or replace a sub-processor that processes Customer Data, we will update this page and notify customers by email to the account owner at least 30 days before the change takes effect, so you have the opportunity to object as described in our Data Processing Agreement.
Contact
Questions about this list or our data protection practices: support@floxa.co.uk.