Legal
Sub-processors
Last updated 2026-10-23 · We'll email tenant admins at least 30 days before adding a new sub-processor that processes customer data.
CoreFlow OS uses the following third-party services to operate. Each one only sees the data category listed in the table; entries marked "gated" require an explicit tenant-level opt-in (analytics consent, OAuth connect, etc.).
| Service | Purpose | Data categories | Region | Retention |
|---|---|---|---|---|
| Supabase (Postgres + Auth + Storage) | Primary data store, authentication, file storage for exports | All | US | Until tenant deletion + 60d billing-records retention |
| Stripe | Subscription billing, payment processing, tax calculation, invoicing | Billing identity, payment card metadata, invoice line items | US | Per Stripe's data-retention policy (typically 7 years for financial records) |
| Anthropic (Claude) | LLM completions for Aria chat, comms classifier, meeting profile generator | Prompts (including any customer text in context), no PII training opt-in | US | Per Anthropic API Terms (no training on API inputs by default; 30-day operational retention) |
| OpenAI (text-embedding-3-small) | Embeddings for semantic-memory RAG | Source text (chat logs, inbox messages, initiative artifacts) at index time | US | Per OpenAI API Terms (30-day operational retention; no training on API inputs) |
| Resend | Transactional email (signup magic links, billing notices, new-device alerts, RTBF confirmations) | Recipient email address, email body content | US | Per Resend's logs retention (90 days at the time of writing) |
| PostHog (US Cloud) 🛡️ Tenant-level opt-in via organizations.analytics_consent | Product analytics, event tracking, retention/funnel analysis | Anonymized event names + properties; user.id as distinct_id (no email/name) | US | Per tenant retention policy in PostHog (12 months default) |
| Sentry | Error tracking and performance monitoring | Stack traces, request metadata (route, method, status); user.id when logged in | US | Per Sentry's plan (90 days at the time of writing) |
| Microsoft Graph 🛡️ Per-tenant OAuth connect via Settings → Integrations | Outlook (mail + calendar + tasks) integration | Email metadata + content, calendar events, tasks (only what user grants via OAuth scope) | US/EU (per Microsoft's data residency) | Cached in CoreFlow per tenant retention; original data stays in customer's Microsoft tenant |
| Google Workspace (Gmail, Calendar, Tasks) 🛡️ Per-tenant OAuth connect via Settings → Integrations | Google Workspace integration for email, calendar and task sync | Email metadata + content, calendar events, tasks (only what the user grants via OAuth scope) | US/EU (per Google's data residency) | Cached in CoreFlow per tenant retention; original data stays in the customer's Google account |
| DigitalOcean (Gradient AI inference) 🛡️ Platform-level inference backend selection | OpenAI-compatible LLM inference backend for Aria chat when configured | Prompts (including any customer text in context); no training on API inputs | US | Per DigitalOcean's API terms (operational logs only) |
| Plaid 🛡️ Per-tenant bank connect via CFO → Bank Feed | Bank account connections and transaction feeds for the CFO workspace | Institution and account identifiers, account names/types, masked account numbers, currencies, balances and transaction details (only authorized linked accounts) | US | Plaid retains information under its End User Privacy Policy. CoreFlow preserves imported bookkeeping records after bank disconnection; verified deletion requests and retention targets are described in /privacy#retention. |
| Nylas 🛡️ Per-tenant connect via Settings → Integrations (not enabled by default) | Optional email/calendar connector for providers without a direct OAuth integration | Email metadata + content, calendar events (only what the user grants) | US | Per Nylas's privacy policy; cached in CoreFlow per tenant retention |
| Merge.dev 🛡️ Per-tenant connect via Settings → Integrations (not enabled by default) | Optional unified connector for CRM and accounting systems | Contacts, companies, deals and accounting records from the systems the tenant links | US | Per Merge's privacy policy; synced records cached per tenant retention |
| Vercel | Application hosting, edge network, deployment platform | Request metadata (IP, user-agent), application logs | US (primary); edge nodes globally | 30 days for request logs |
Object to a sub-processor
Tenant admins can object to a new sub-processor on reasonable grounds. Email admin@monolithdata.com within 30 days of notification. Per the DPA §5, we'll work with the tenant to find a path forward; if none exists, you may terminate per the Agreement.