These are the third parties CriticalFlow relies on to deliver the service — the vendors that process or store customer data on our behalf. We don't sell customer data; the only other, limited disclosures we make (legal process, professional advisers, a genuine business sale) are described in our Privacy Policy.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication, and serverless functions | All application data, including project/crew/financial records and user account details | Singapore (ap-southeast-1) |
| Cloudflare | Content delivery network, static hosting, and DNS | In-transit traffic only — page assets and network requests passing through Cloudflare's edge | Global edge network |
| Resend | Transactional email delivery (invites, password resets, notifications) | Recipient email address and message content of transactional emails sent by the app | United States |
| Anthropic | AI help copilot — answers in-app questions about how to use CriticalFlow | Application documentation and the user's own typed question. Never sees actual tenant/organisation data (people, projects, financials). | United States |