These are the third parties CriticalFlow relies on to deliver the service — the vendors that process or store customer data on our behalf. We don't sell customer data; the only other, limited disclosures we make (legal process, professional advisers, a genuine business sale) are described in our Privacy Policy.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication, and serverless functions | All application data, including project/crew/financial records and user account details | Singapore (ap-southeast-1) |
| Cloudflare | Content delivery network, static hosting, and DNS | In-transit traffic only — page assets and network requests passing through Cloudflare's edge | Global edge network |
| Resend | Transactional email delivery (invites, password resets, notifications) | Recipient email address and message content of transactional emails sent by the app | United States |
| Anthropic | AI help assistant (questions about how to use CriticalFlow) and the Copilot (questions about the organisation's own plan; drafts changes that only take effect if the user approves them) | Help assistant: product documentation and the user's typed question only. Copilot: the typed question plus the organisation data the asking user's own role can already see on screen (people, schedule, projects, financial figures at that access level), sent per question to answer it — not used to train models under Anthropic's commercial terms. | United States |