Third parties and sub-processors
Version 2026-10-18 · In effect from October 18, 2026
Published versions: 2026-10-18
01 Purpose and authorization
This document identifies the third parties involved in CORD and implements section 5 of the Data Processing Agreement. “Flouvia”, “Customer”, “CORD” and other defined terms have the meaning given to them in the CORD Terms and Conditions.
The Customer gives Flouvia general authorization to engage the sub-processors in section 2. The current list is published on the Sub-processors page, which shows each one’s legal entity, country and transfer mechanism and the announced changes.
02 Sub-processors
They process Customer Data on Flouvia’s behalf:
| Provider | Entity and country | Function | Transfer mechanism |
|---|---|---|---|
| Neon | Databricks, Inc., United States | PostgreSQL database holding account, operational and customer data. | EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses. |
| Vercel | Vercel Inc., United States | Hosting, request execution, technical logs, web and performance analytics only with consent, and bot detection. | EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses. |
| Anthropic | Anthropic, PBC, United States | Artificial intelligence features: text, images and PDFs with the necessary context, only when a feature is invoked. It deletes API inputs and outputs after 30 days, subject to the exceptions in its policy. | Standard Contractual Clauses and UK addendum. |
| Resend | Plus Five Five, Inc., United States | Transactional email, newsletter and, when turned on, inbound email. | EU–U.S. Data Privacy Framework and UK extension; Standard Contractual Clauses. |
| PostHog | PostHog, Inc., United States | Product analytics; in the browser, only with consent. | EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses. |
| Upstash | Upstash, Inc., United States | Usage limits and short-lived technical sessions. | EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses. |
| Slack | Slack Technologies Limited, Ireland | Flouvia’s internal operational alerts, without data of the Customer’s customers. | Standard Contractual Clauses and UK addendum. |
| Facturapi | Facturapi S.A. de C.V., Mexico; processes the data on servers in the United States | Preparation, stamping, cancellation and retrieval of CFDI, including payment complements and global invoices, in Mexico. It stamps through its authorized certification provider, Prodigia. | Processor contract under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. For a Customer subject to the GDPR, the rule in section 6 of the Data Processing Agreement. |
03 Providers with their own obligations
These providers receive data to provide their own service and are responsible for it under their own terms; they are not Flouvia’s sub-processors:
- Stripe: subscriptions, payments, refunds, disputes, payouts, identity verification, payment methods and mandates, and U.S. sales tax calculation.
- Mercado Pago: payments with the Customer’s Mercado Pago account.
- Google and Apple: sign-in chosen by the person.
04 Authorities and Customer-directed integrations
Tax authorities (SAT through the PAC, AEAT, ARCA, Sefin Nacional, SEFAZ and the SII) receive documents under the Customer’s legal obligation, only when the rail for its country is enabled and the Customer has configured it. Issuing invoices in France through an approved platform is not yet available and no third party receives data for that purpose; when Flouvia enables it, it will update this document with a new version.
The integrations the Customer connects (Google Sheets and Gmail, Microsoft Excel and Teams, Intuit QuickBooks Online, Xero, Shopify, Meta’s WhatsApp Business, HubSpot, Slack, platforms using the API, MCP servers, its identity provider and its webhooks) receive data on the Customer’s instruction and under the Customer’s relationship with those third parties. They are not Flouvia’s sub-processors.
05 Change notices and objections
Anyone can subscribe by email to change notices on the sub-processor page. Flouvia will give at least 30 days’ notice before adding or replacing a sub-processor, or changing its purpose, and the notice will be published on the page with its effective date.
The Customer may object to the change in writing to legal@flouvia.com before it takes effect, on reasonable data protection grounds. If the parties do not resolve the objection in good faith, the Customer may terminate the affected services and Flouvia will refund the unused prepaid portion.
When a change is necessary to address an urgent security risk or a provider failure, Flouvia may make it immediately and will give notice as soon as possible, with the same right to object from the notice.
06 Obligations Flouvia imposes
Before a sub-processor processes Customer Data, Flouvia enters into a contract with it imposing data protection obligations equivalent to those of the Data Processing Agreement, and keeps the evidence: the accepted processing agreement, its date, the account identifier, the list of its own sub-processors and its transfer mechanism. Flouvia remains liable to the Customer for each sub-processor’s performance.
07 Data location and transfers
The main sub-processors process data in the United States. Facturapi only processes the data of CFDI issued by businesses established in Mexico, and its processor contract is governed by Mexican law. If a Customer is subject to the GDPR, the safeguard for the transfer to Facturapi is the Standard Contractual Clauses, module 3, annexed to that contract, and until Facturapi has signed them, that Customer must not use CFDI stamping to invoice persons located in the European Economic Area, under section 6 of the Data Processing Agreement. Other transfers are governed by section 6 of the Data Processing Agreement: the Data Privacy Framework when the sub-processor is certified, and the Standard Contractual Clauses otherwise. Flouvia checks that each certification is still in force before each publication of this list.
08 Final provisions
In case of conflict, the Data Processing Agreement prevails. Governing law and jurisdiction are those in section 16 of the Terms. Sub-processor changes follow section 5 of this document, and other amendments follow section 17 of the Terms.