Skip to main content
DayOneFlow, home

Trust

Subprocessors

The third-party services that process personal data on our behalf to run DayOneFlow, what each one receives, and where.

Last updated

Draft: providers to be confirmed

This list is Annex III of our draft Data Processing Agreement, which counsel is reviewing. Provider names, locations and transfer safeguards in [square brackets] are still to be confirmed and will be completed before DayOneFlow is offered to customers.

Current subprocessors

Services that process your organization's personal data so we can provide DayOneFlow.

Subprocessors that process customer personal data, with their purpose, the personal data they receive, their location and the transfer safeguard
SubprocessorPurposePersonal dataLocationTransfer safeguard
[hosting provider]The virtual server that runs DayOneFlow: database, stored files, local backups and logsAll customer data[location][mechanism]
[email provider]Sending emails (SMTP)Recipient's name and email address, organization name, job title, dates and personal links. Never salaries[location][mechanism]
[backup storage provider]Storing encrypted off-server backupsAll customer data, encrypted with GPG before it leaves our server. The provider holds no key[location][mechanism]

Scroll the table sideways to see every column.

Other services

Services we use that receive little or no customer personal data.

Other services, what we use them for and the personal data they receive
ServiceWhat we use it forPersonal data
GoogleSign in with Google, only where it is enabled and a staff user chooses itThe staff user's Google account identifier, name, email address and profile picture link. No Google access tokens are stored. [TO CONFIRM: Google acts as an independent controller, not a subprocessor]
[uptime monitoring provider]Checks from outside that DayOneFlow is reachableNone. The health check returns only a status, a time and the database check result
[alert channel provider]Delivers operational alerts to our operatorsNone. Alerts contain check names and counts. [TO CONFIRM]
[code hosting and CI provider]Holds the source code and runs the automated testsNone. Tests use synthetic data only. [TO CONFIRM]

Scroll the table sideways to see every column.

We use no analytics, advertising or tracking services, and the website loads no third-party scripts, fonts or images.

Changes to this list

  • We give customers [30] days' notice of any new or replaced subprocessor.
  • A customer may object on reasonable data-protection grounds. If we cannot resolve the objection, the customer may end the agreement.
  • Each subprocessor is bound by data-protection terms no less protective than our DPA, and we remain responsible for its work.
  • When this list changes, we update the date at the top of this page.

Questions

Ask our privacy contact at privacy@dayoneflow.com. The full terms are in the Data Processing Agreement.

Related in the Trust Center