Sub-processors

These companies process a firm's data to run Arqiflow. Each handles only what its job needs, under a written agreement that protects it as our Data Processing Addendum does.

• Hetzner Online GmbH
  Purpose

  Hosting: the server, the web app and the database
  Data it handles

  All of a firm's data in Arqiflow, except files
  Location

  EU (Finland)
• Cloudflare, Inc.
  Purpose

  Network in front of Arqiflow (DNS, encryption, delivery) and file storage (R2)
  Data it handles

  Traffic to and from Arqiflow; uploaded files and pictures
  Location

  Global network; files: Western Europe
• Supabase, Inc.
  Purpose

  Sign-in: accounts, passwords and sessions
  Data it handles

  Name, email address, sign-in method
  Location

  EU (Ireland)
• Anthropic, PBC
  Purpose

  The agent's AI model (Claude), and its web search
  Data it handles

  What a person asks their agent and what the agent reads to do it
  Location

  United States
• Google LLC
  Purpose

  Search by meaning (text embeddings, Gemini API)
  Data it handles

  The text of Knowledge pages and of the agent's memory notes, to index them
  Location

  United States
• Resend, Inc.
  Purpose

  Email: invitations, notifications, and email sent to a project's address
  Data it handles

  Name, email address, the email's content
  Location

  United States
• Creem
  Purpose

  Payments, as merchant of record: checkout, cards, invoices and tax
  Data it handles

  Billing contact, firm name, seats and plan
  Location

  Estonia (EU)

• Apps your firm connects. Google Drive and Calendar, OneDrive, SharePoint and Outlook, Dropbox, Arqina, and the services a firm imports from (Asana, monday.com, Trello, ClickUp). Data goes to them when someone in the firm connects them, under the firm's own agreement with each.
• Sign-in with Google or Microsoft. When you choose to sign in with them, they confirm who you are, under your agreement with them.
• Public map and data sources. To describe a project's site, the server asks public sources about the site's location: OpenStreetMap, NASA POWER, Esri World Imagery, IGN and the French cadastre, Overture Maps, Wikidata and Wikimedia Commons. They receive a location, not who is asking or the firm's work.

We tell firms' owners by email at least 30 days before a new sub-processor starts processing their data, and update this page. A firm may object as the DPA sets out. Questions: [email protected].