Legal
Subprocessors
Last updated: 25 October 2026
Current production providers
Only providers actually enabled for the deployment are listed. The operator must verify the legal entity, location and data-processing terms before launch.
| Provider | Purpose | Processing location | Data category |
|---|---|---|---|
| Operator-configured VPS hosting | Application, PostgreSQL, Redis and PDF artifact hosting | Operator-dependent — verify | Account, company, invoice, order, support and security data |
| Stripe | Paid subscription checkout, billing portal and webhook lifecycle — only when Stripe billing is configured | Stripe’s global infrastructure — verify current terms | Billing contact, company identifiers and subscription/payment metadata |
Not currently configured
No transactional email provider is listed unless the operator has enabled one. When Resend or an operator SMTP relay is configured, add the actual legal entity, processing location and DPA details here before production use. Error-monitoring, analytics and object-storage providers are also listed only when actually enabled; InvoiceFlow does not present hypothetical providers as active subprocessors.
Operator duties
The operator must maintain a current list, notify customers where required, verify data-processing agreements and assess international transfers. This page is a template for review, not a substitute for a DPA or legal advice.
Controller identity
Operator legal name not configured
Operator address not configured
Operator email not configured
Support: not configured · Privacy: not configured · Legal: not configured
Contact us with legal or privacy questions.