Sub-processors
Flok engages the providers below to deliver the service. Each processes personal data on our instructions under a written data processing agreement.
This table is generated from the same record that publishes the list on our security page, so the two cannot disagree. DPA means a data processing agreement is in place. SCC means the transfer additionally relies on the EU Standard Contractual Clauses together with the Swiss addendum, because the processing happens outside Switzerland and the EEA.
The table itself is published in English in every language. It is a record of what each provider is and does, kept as one set of facts rather than five that could drift apart.
| Provider | Purpose | Location | Certifications | Agreement |
|---|---|---|---|---|
| Infomaniak (Infomaniak Network SA) | Pilot AI features — drafting, matching, summarising and reading a photographed receipt, with a human approving before anything sends, charges or is booked; also the public support assistant on event pages. Requests are not stored or logged. | Switzerland (Infomaniak's own data centres) | ISO 27001:2022, ISO 9001, ISO 14001, ISO 50001 | DPA |
| Vercel | Static site hosting, object storage (encrypted backups), cookieless web analytics | Frankfurt, DE (eu-central-1) | Publishes its own SAQ-D AoC and a customer responsibility matrix via its Trust Center | DPA |
| Supabase | Database, authentication | Zürich, CH | Per Supabase's own published certifications | DPA |
| Stripe (club's own account) | Payment processing on each club's own connected Stripe account. The club is Stripe's customer; Flok facilitates a full-redirect connection and no cardholder data touches Flok. | Per club's Stripe account | PCI DSS Level 1 Service Provider | DPA |
| Stripe (Flok's own billing) | Flok's own merchant account, used to collect Flok subscription fees from club administrators. Here Flok is Stripe's customer, and Stripe processes administrator name, email address, payment method and billing address on Flok's behalf. | Flok's Stripe account | PCI DSS Level 1 Service Provider | DPA |
| Payrexx | Payment processing (each club's own connected account) — tenant-held contracts only | St. Gallen, CH | PCI DSS Level 1 Service Provider | DPA |
| Resend | Transactional email, newsletter delivery | Ireland, EU (eu-west-1) | See Resend's own documentation | DPA |
| Sentry | Error tracking (no cardholder data; scrubbed of common PII patterns) | Germany, EU | Per Sentry's own published certifications | DPA |
What each provider receives
| Provider | Personal data it can see |
|---|---|
| Vercel | Request metadata for static assets, including IP address; encrypted backup blobs it cannot read (GPG-encrypted before upload, private key held offline); cookieless, aggregated traffic statistics |
| Supabase | All member, event, invoice, newsletter and account data — this is the primary datastore |
| Stripe ① | Whatever the club's own checkout collects; Flok does not receive or store card data |
| Stripe ② | Administrator name, email address, payment method and billing address |
| Payrexx | Whatever the club's own checkout collects; Flok does not receive or store card data |
| Resend | Recipient email address, sender, subject and message content, plus delivery, bounce and open/click events |
| Sentry | Error stack traces and technical context from production builds; the SDK's personally-identifying data option is not enabled |
| Infomaniak | The specific content submitted for each enabled Pilot feature — see the AI Data Addendum for the per-feature breakdown |
Changes to this list
We will notify your account's registered contact at least 30 days in advance by email, and update this page, before adding or replacing a sub-processor. You may object on reasonable data-protection grounds within that period; the objection procedure is set out in section 9 of our Data Processing Agreement.