FlashTower uses the subprocessors below to provide the Service. Each is bound by written confidentiality, security, and data-protection obligations. FlashTower gives at least 30 days' advance notice before a new subprocessor begins processing Customer Data, as described in the Data Processing Addendum.
1. Current subprocessors
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, content delivery, and serverless compute | All data processed by the Service while in transit through the application; request logs | United States |
| Supabase Inc. | Database, authentication, and file storage | Account data, organization data, assessment, monitoring, and Guard records, uploaded evidence files | United States |
| Stripe, Inc. | Payment processing and subscription billing (Boostlete LLC is the merchant of record) | Billing contact details, payment method details (held by Stripe), transaction records | United States |
| Plus Five Five, Inc. | Transactional and notification email delivery | Recipient email addresses and the content of system emails | United States |
| PostHog, Inc. | Product analytics through a first-party proxy, with autocapture and session recording turned off | Pseudonymous identifiers, page views, and allow-listed product events (no assessment content) | United States |
| Functional Software, Inc. | Error monitoring, with session replay turned off | Error diagnostics with request bodies, cookies, and personal data scrubbed before transmission | United States |
| Anthropic, PBC | Optional AI-generated narrative, used only when a customer organization enables AI features | Finding titles and explanations and the organization's AI system names, redacted (only when the organization enables AI explanations) | United States |
| Hosting.com | Business email hosting for correspondence with FlashTower personnel | Contents of emails you send to or receive from FlashTower addresses | United States |
Anthropic receives data only for organizations that enable AI features. Hosting.com hosts FlashTower's business mailboxes and processes only correspondence you exchange with FlashTower personnel. Integrations a customer connects (for example, a third-party service linked to FlashTower) are that customer's own vendors, not FlashTower subprocessors.
2. Notifications and objections
To receive email notice of changes, email privacy@flashtower.com with the subject “Subprocessor notifications”. Customers may object to a new subprocessor on reasonable data-protection grounds within the 30-day notice period. If FlashTower cannot reasonably accommodate the objection, the customer may terminate the affected Service and receive a pro-rata refund of prepaid, unused fees, which is the sole remedy for the objection.
Contact
FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.