Filarr’s sub-processors, and where they process your data.
The third parties below process data on Filarr’s behalf. Our analytics (Plausible) is self-hosted on our own infrastructure: it is therefore not a sub-processor, and its data goes to no third party.
Updated 27 October 2026
| Sub-processor | Role | Data | Location | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | API compute (Workers), database (D1), encrypted-file storage (R2), rate limiting (KV) | Accounts, file metadata, audit logs, encrypted blobs (opaque), anti-abuse counters | United States (company) · R2 and D1 data in Cloudflare’s “Western Europe” region (location hint, no binding jurisdiction) | Standard Contractual Clauses (SCCs) · content end-to-end encrypted, unreadable by the sub-processor, except databases entrusted to the hosted black box (next row) |
| Cloudflare, Inc. — black box hosted by Filarr (option) | Running the hosted service (Workers); storing each box’s state (Durable Objects); routing the box API’s requests and responses, terminating encryption in transit (TLS) | For the databases the customer entrusts to the hosted box only: all their rows and columns, what is written to them, the software’s requests and the responses, the key and rows of a connected external database, received files while they pass through. This data is not end-to-end encrypted: it is decrypted in memory by the hosted service and, in transit, at the point of presence that receives the request | United States (company) · Durable Objects created in the European Union jurisdiction (storage and execution in the EU) · transit through the point of presence nearest the caller, which may be outside the EU | Standard Contractual Clauses (SCCs) · EU jurisdiction of the Durable Objects · no logging of content · see the DPA annex for the hosted box |
| Vercel Inc. | Website hosting & delivery (CDN); performance metrics (Web Vitals) | HTTP request logs, performance metrics | United States (global CDN) | Standard Contractual Clauses (SCCs) |
| Stripe, Inc. / Stripe Payments Europe | Payment & subscription processing | Card data (handled by Stripe, never stored by Filarr), customer id, billing history; for the hosted black box, the number of boxes billed, with no access to the databases or their content | United States / Ireland (EU) | PCI DSS Level 1 · SCCs for transfers |
| Resend | Service transactional email (verification, team invitations, billing notices) | Recipient email address, transactional message content | United States | Standard Contractual Clauses (SCCs) |
| OVH SAS | Contact / waitlist form email; domain-name registrar | Name, email and message submitted in the form; DNS records | France (Roubaix) | Hosting and processing within the EU |
| Sentry | Desktop app error reports, on by default and can be turned off (Settings → System) | Error message and trace, version, system, random profile code, last actions in the app; can mention a file name or a path, never file content | EU ingestion (de.sentry.io) | EU ingestion region · SCCs |
| Google LLC (Firebase Cloud Messaging) | Android app notifications (mentions, tasks, comments in a shared vault) | Device notification token, a “who did what” sentence and technical identifiers; never a note title or excerpt | United States (company), Google’s global network | Firebase data processing terms · content minimised by design |
Notification and objection
We update this list before adding or replacing any sub-processor. To be notified of changes, email contact@filarr.com. A business customer may object to a new sub-processor; if we cannot accommodate the objection, the customer may terminate the affected service.
Reminder: for the content of files and notes, end-to-end encryption means no sub-processor — including the storage host — has access to the plaintext. The only exception, at the customer’s choice: the databases it entrusts to the black box hosted by Filarr, which are no longer end-to-end encrypted while they remain entrusted.