Legal & compliance
Sub-processor decision matrix.
Every third-party service that processes operator or customer personal data on behalf of multiflow, disclosed openly. Material changes notified 30 days before they take effect.
Last updated · April 17, 2026
16
Active vendors
14
DPAs signed
30d
Change notice
US
Primary region
For GDPR / UK-GDPR operators: this list is the authoritative sub-processor list referenced in our Data Processing Addendum (DPA). If your DPA requires notification of sub-processor changes, subscribe via privacy@multi-flow.pro.
All vendors at a glance
AWS
CF
SB
EL
CB
ES
EV
AL
FD
PM
TW
SL
VF
ET
SI
SY
DD
Vendor decision matrix
| Vendor | Category | Data touched | Region | DPA |
|---|---|---|---|---|
AWS
Amazon Web Services | Infrastructure | Operator account dataTransaction metadata | US (us-east-1, us-west-2) | Signed |
CF
Cloudflare, Inc. | Infrastructure | IPRequest headers | Global edge | Signed |
SB
Supabase, Inc. | Infrastructure | Portal authOperator ledger | US | Signed |
EL
Elavon, Inc. | Acquiring | PANCardholder data | US | Signed |
CB
Chesapeake Bank | Acquiring | PANCardholder data | US | Signed |
ES
Esquire Bank | Acquiring | PANCardholder data | US | Signed |
EV
Evolve Bank & Trust | Acquiring | PANCardholder data | US | Signed |
AL
Alloy | KYC / KYB | Legal nameSSN/EINDOB | US | Signed |
FD
FIDO2 / WebAuthn | Auth | Public keyDevice metadata | Client-side | N/A |
PM
Postmark | Comms | Email addressMessage body | US | Signed |
TW
Twilio | Comms | Phone numberOTP body | US | Signed |
SL
Slack Technologies | Comms | NameEmailChat content | US | Signed |
VF
Verifi (Visa) | Fraud | Transaction IDPAN hash | US | Signed |
ET
Ethoca (Mastercard) | Fraud | Transaction IDPAN hash | US | Signed |
SI
Sift | Fraud | Device fingerprintBehavior signals | US | Signed |
SY
Sentry | Observability | Stack tracesUser ID | US | Signed |
DD
Datadog | Observability | Infra metricsUptime probes | US | Signed |
AWS
Amazon Web Services
Category
Infrastructure
Data
Operator account dataTransaction metadata
Region
US (us-east-1, us-west-2)
DPA
Signed
CF
Cloudflare, Inc.
Category
Infrastructure
Data
IPRequest headers
Region
Global edge
DPA
Signed
SB
Supabase, Inc.
Category
Infrastructure
Data
Portal authOperator ledger
Region
US
DPA
Signed
EL
Elavon, Inc.
Category
Acquiring
Data
PANCardholder data
Region
US
DPA
Signed
CB
Chesapeake Bank
Category
Acquiring
Data
PANCardholder data
Region
US
DPA
Signed
ES
Esquire Bank
Category
Acquiring
Data
PANCardholder data
Region
US
DPA
Signed
EV
Evolve Bank & Trust
Category
Acquiring
Data
PANCardholder data
Region
US
DPA
Signed
AL
Alloy
Category
KYC / KYB
Data
Legal nameSSN/EINDOB
Region
US
DPA
Signed
FD
FIDO2 / WebAuthn
Category
Auth
Data
Public keyDevice metadata
Region
Client-side
DPA
N/A
PM
Postmark
Category
Comms
Data
Email addressMessage body
Region
US
DPA
Signed
TW
Twilio
Category
Comms
Data
Phone numberOTP body
Region
US
DPA
Signed
SL
Slack Technologies
Category
Comms
Data
NameEmailChat content
Region
US
DPA
Signed
VF
Verifi (Visa)
Category
Fraud
Data
Transaction IDPAN hash
Region
US
DPA
Signed
ET
Ethoca (Mastercard)
Category
Fraud
Data
Transaction IDPAN hash
Region
US
DPA
Signed
SI
Sift
Category
Fraud
Data
Device fingerprintBehavior signals
Region
US
DPA
Signed
SY
Sentry
Category
Observability
Data
Stack tracesUser ID
Region
US
DPA
Signed
DD
Datadog
Category
Observability
Data
Infra metricsUptime probes
Region
US
DPA
Signed
Want the signed DPA? Email privacy@multi-flow.pro with your legal entity and we'll send a countersigned DPA + this sub-processor list as an annex within one business day.