Compliance & Legal
Infrastructure Subprocessors
Last updated: October 15, 2026 · Effective immediately
1. Overview
FlockPush engages selected third-party subprocessors to assist in providing secure, resilient cloud infrastructure. Each vendor undergoes rigorous security and privacy audits before engagement.
2. Authorized Subprocessors
| Subprocessor | Primary Purpose | Data Location | Security Safeguards |
|---|---|---|---|
| Neon (Neon, Inc.) | Serverless Postgres database hosting & multi-tenant storage | United States (AWS us-east-1) | SOC 2 Type II, ISO 27001, Encryption at rest and in transit |
| Cloudflare (Cloudflare, Inc.) | Edge CDN, WAF, DDoS protection, and R2 media object storage | Global Edge Network | SOC 2 Type II, ISO 27001, PCI-DSS Level 1, EU Standard Contractual Clauses |
| Google Cloud Platform (Google LLC) | Cloud Run container execution, Cloud KMS credential encryption, Secret Manager | United States | SOC 1/2/3, ISO/IEC 27001, FIPS 140-2 validated KMS HSMs |
| Resend (Resend, Inc.) | Transactional email delivery, member invitations, and verification notices | United States | SOC 2 Type II, GDPR compliant, TLS 1.3 in transit |
| New Relic (New Relic, Inc.) | Real-time error tracking, distributed tracing, and application performance monitoring (APM) | United States | SOC 2 Type II, ISO 27001, strict data scrubbing & token redaction |
| Mixpanel (Mixpanel, Inc.) | Product usage analytics and user behavior funnel measurement (zero content payload rule enforced) | United States | SOC 2 Type II, GDPR compliant, content-scrubbed metadata only |
| Stripe (Stripe, Inc.) | Subscription billing and payment processing (Phase 2) | United States | PCI-DSS Level 1, SOC 1/2, GDPR compliant |
3. Subprocessor Updates
We maintain an updated list of subprocessors on this page. For customers on enterprise terms, we provide advance notification of any new infrastructure provider additions.
Questions regarding our policies?
Contact our privacy and compliance desk at privacy@flockpush.com