subprocessors
last updated 2026-08-17 · briven.tech
This page lists every third-party service that processes briven Customer data on behalf of flndrn Limited (the Operator), a company registered at Arch. Makariou III 171, Vanezis Business Center 4th floor, 3027 Limassol, Cyprus. Where a subprocessor is “planned”, the integration is not live and no customer data reaches it yet; we list them here so you can audit what your account will be exposed to as features turn on.
Two things that would normally appear on a list like this are absent, deliberately. The object storage (MinIO) and every PostgreSQL instance — the control plane, the shared cluster that free-tier databases live in, and the per-project containers on paid plans — run as part of the Operator’s own deployment, on the Operator’s own infrastructure. They are not third parties, so no data-processing agreement stands between you and your rows: your database contents never leave the server the platform runs on.
Each subprocessor is engaged under a data-processing agreement that limits them to the purpose stated below. Transfers outside the EU rely on Standard Contractual Clauses with appropriate supplementary measures (TLS in transit, AES-256 at rest, minimisation of what we send to each processor).
| subprocessor | purpose | location | status |
|---|---|---|---|
| Hosting / VPS provider | Compute, storage and bandwidth for the whole platformThe entire deployment — dashboard, control plane, customer PostgreSQL, the connection pooler and the object store — runs on this provider's server. We are not naming the provider or the region until we can state both accurately: an unverified location on this list is worse than an admitted gap, because it is the fact a customer would rely on when deciding whether an international transfer is involved. Ask us at legal@flndrn.com if you need it confirmed before you sign. | pending confirmation | active |
| Let's Encrypt (Internet Security Research Group) | Issuance of TLS certificates for briven.tech and its subdomainsNo personal data is shared beyond the public domain name being certified. Renewals are automatic via ACME. | United States (CA-domiciled) | active |
| Transactional email provider (SMTP) | Delivery of sign-up verification, one-time sign-in codes, password resets and account noticesThe mail provider is configured at deployment time and is not named in the codebase, so neither the vendor nor its region is stated here — see the note on the hosting entry for why we would rather admit that than guess. It sees your email address and the contents of those messages, and nothing about your databases. Card data never flows through it. | pending confirmation | active |
| Payment processor | Subscription billing, checkout, invoicing and taxationNo payment provider is wired into the codebase yet — the billing service says so explicitly — so paid plans are not billable and no card data exists anywhere. This row is listed so you can see the gap before it is filled, and the change-notification policy below applies when it is. | Not yet determined | planned |
change-notification policy
We will publish material changes to this list at least 30 days before a new subprocessor starts processing customer data. “Material” means: adding a subprocessor, replacing one with a substantively different service, or expanding the scope of an existing subprocessor’s access to a category of data not previously covered. Notifications appear on this page and are emailed to account owners.
If a subprocessor change is unacceptable for your use case, you may close your account and export your data without penalty within 30 days of the notice. Export is a standard pg_dump over your normal connection — see the Trust page.
questions
Contact privacy@flndrn.com for any subprocessor-related question, including requests for the underlying data-processing agreements where they are not publicly available. See also the Privacy Policy.