Subprocessors
flowscope engages the following third parties to deliver and operate its services. Each is contracted under enterprise terms, processes data in United States regions, and is subject to data-protection obligations at least as protective as those flowscope owes its customers under the Master Services Agreement and Data Processing Addendum. flowscope remains liable to the customer for the acts and omissions of its subprocessors.
Current list
| Subprocessor | Purpose | Data touched | Region | Retention |
|---|---|---|---|---|
| Azure AI Language (Microsoft) | Server-side PII detection applied before persistence per MSA §6.7(b) | Captured Workflow Data passed through PII detection | United States | Synchronous processing; no storage |
| Azure Document Intelligence (Microsoft) | OCR and structured parsing of customer documents | Document content submitted for parsing | United States | Deleted within 24 hours |
| OpenAI | LLM API for parsing, reasoning, and generation | Parsed content, prompts, embeddings, outputs | United States | Zero Data Retention |
| Azure Container Apps (Microsoft) | Application hosting | Application traffic, encrypted environment variables | United States | Standard Microsoft terms |
| Azure Database for PostgreSQL Flexible Server (Microsoft) | Managed PostgreSQL | Customer data persisted by the application | United States | Platform retention policy (contract term plus a 30-day tail by default) |
| Azure Storage (Microsoft) | Object and document storage | Document blobs and object data persisted by the application | United States | Platform retention policy (contract term plus a 30-day tail by default) |
| Azure Communication Services (Microsoft) | Transactional email (notifications, invitations) | Recipient addresses, rendered message bodies | United States | Standard Microsoft terms |
| Vercel | Hosting for the public marketing site (flowscope.com) | Site visitor data (IP addresses, user agents) and marketing lead-form submissions; no customer platform data | United States | Standard Vercel terms |
| Google Workspace (OAuth) | Customer-side authentication | OAuth identity claim only; flowscope does not store passwords | United States | N/A |
| Microsoft Entra ID (OAuth) | Customer-side authentication | OAuth identity claim only; flowscope does not store passwords | United States | N/A |
The current authoritative list is maintained at this URL and is also reproduced in Appendix A of the customer-facing white paper.
Notification of changes
Per the Data Processing Addendum, flowscope notifies customers in writing before engaging any new subprocessor that materially changes the categories of personal data processed or the jurisdictions in which such data is processed. Customers have fifteen days from notification to object to a new subprocessor that processes personal data outside the United States, after which the parties work in good faith to resolve the objection (for example by identifying an alternative subprocessor or implementing additional safeguards).
To receive change notifications, email security@flowscope.com with the subject line "Subscribe: subprocessor changes" and the customer organization name. The mailing list is managed by flowscope and used solely for this purpose.
Historical changes
Subprocessor additions and removals are logged here with the effective date and a one-line description.
- 2026-07-22 · Added Azure Storage (Microsoft) to the list as a clarification; storage has been part of the Azure platform footprint since launch.