Subprocessors
In short: all Customer Content lives in AWS in the United States. Every other vendor below either supports our own operations or, in Intercom’s case, handles support conversations. No subprocessor is authorised to process regulated data without a specific agreement covering both that vendor and that workload.
Current subprocessors
This is the complete list of subprocessors AmazFlow engages to provide or support the Service as of the date above.
| Subprocessor | Location | What it does | Customer Content? |
|---|---|---|---|
| Amazon Web Services, Inc. | United States (us-east-1) | Cloud infrastructure for the entire Service: compute, the control-plane database, object storage, identity, logging, email delivery, and the Amazon Bedrock model runtime used for bounded AI steps. | Yes — all Customer Content is stored and processed here |
| Intercom, Inc. | United States | Customer support messaging on our website and inside the customer console. Receives the identity of a signed-in user (identifier, email, name where held, organisation identifier, role) and whatever a person chooses to write in a support conversation. | Limited — support conversations and user identity, not workflow data |
| Amplitude, Inc. | United States | Product analytics and session replay for the public website only: which marketing pages are viewed, how visitors move through them, and a masked replay of on-page sessions. Runs on the public and sign-in pages and is switched off in both authenticated consoles. | No — excluded from /app and /console, so it does not receive workflow data |
| AWS Amplify Hosting (Amazon Web Services, Inc.) | United States | Static hosting and content delivery for amazflow.com and the browser applications served from it. Processes standard web request metadata such as IP address and user agent. | No — serves the application, does not process workflow data |
| Google LLC (Google Workspace) | United States | Corporate email, documents, and internal collaboration. Used to run AmazFlow as a business, not to operate the Service. | Not intended — may incidentally appear in email correspondence |
| GitHub, Inc. | United States | Source-code hosting, code review, and software delivery pipelines. | No — Customer Content is not stored in source control |
| Aikido Security | European Union | Application, dependency, infrastructure-as-code, and cloud security scanning of our own codebase and infrastructure. | No |
Which ones touch Customer Content
Most vendors on this list never see Customer Content. Stating which do is more useful than a flat list, because it is the distinction that matters in a security review:
- AWS processes all Customer Content. Workflow definitions, execution records, approvals, and audit history are stored in a dedicated, encrypted database in
us-east-1, and bounded AI steps run against a model in the same account. - Intercom processes support conversations and the identity of the person in them. It does not receive workflow definitions, execution records, or audit history.
- Amplitude receives public-website analytics and session replay. It is switched off in both authenticated consoles, so it never receives workflow definitions, execution records, or audit history.
- Everyone else supports AmazFlow’s own operations — hosting, email, source control, security scanning — and is not a path for Customer Content by design or by policy.
Regulated data and BAAs
A vendor’s inclusion on this list authorises it for the purpose described. It does not, by itself, authorise that vendor to process protected health information, payment card data, or other regulated data.
| Subprocessor | Regulated-data status |
|---|---|
| Amazon Web Services, Inc. | Business Associate Addendum available; executed before any PHI-eligible workflow goes live |
| Intercom, Inc. | Not authorised for PHI or other regulated data. Customers must not paste regulated records into a support conversation |
| Amplitude, Inc. | Not authorised for PHI or other regulated data; does not process Customer Content |
| AWS Amplify Hosting (Amazon Web Services, Inc.) | Covered by the AWS agreement above |
| Google LLC (Google Workspace) | Workspace BAA available if PHI is intentionally routed through covered services; not current practice |
| GitHub, Inc. | Not authorised for PHI or customer production content by policy |
| Aikido Security | Not authorised for PHI; integration scope is contractually confirmed |
Notice of changes
AmazFlow will provide at least fifteen (15) days’ notice before adding a new subprocessor that will process Customer Personal Data. Notice is given by updating this page and, where the customer’s agreement requires it, by direct written notice to the customer’s designated contact.
Customers who wish to receive direct notice of subprocessor changes may register a contact address by emailing privacy@amazflow.com.
Objecting to a subprocessor
A customer may object, on reasonable data-protection grounds, to the appointment of a new subprocessor within the notice period. If we cannot resolve the objection by offering a commercially reasonable alternative, the customer may terminate the affected part of the Service without penalty for the remainder of the then-current term, as set out in the Data Processing Agreement.
Questions
Questions or change requests: privacy@amazflow.com. Contractual notice commitments are governed by the customer’s agreement and the Data Processing Agreement.