Sub-processors

Infrastructure

Supabase, Inc. (USA) — database, authentication, file storage and Edge Functions; the project is hosted in Frankfurt (AWS eu-central-1), and Edge Functions run in the Supabase region nearest to the caller. Purpose: accounts, templates, render metadata, fonts; the Edge Functions pass the editor’s preview renders to the render servers, send emails, handle billing and fetch templates imported from other providers.

Fly.io, Inc. (USA) — render, conversion and conformance servers in Frankfurt (fra). Purpose: Chromium rendering of documents, filling Word and PowerPoint templates, converting uploaded office documents to PDF with LibreOffice, and turning PDFs into e-invoices (PDF/A-3 with the invoice as XML) and validating e-invoices and PDF/UA files; no persistent storage of customer data.

Cloudflare, Inc. (USA) / Cloudflare Germany GmbH — API gateway, CDN, key-value store and object storage (R2). Purpose: request handling at the edge and short-lived caches of key metadata, template versions and idempotent replies; delivery and storage of rendered outputs, library files, brand logos and Word and PowerPoint template files (R2, EU jurisdiction).

Communication and billing

Resend, Inc. (USA, EU standard contractual clauses) — email. Purpose: sign-in links, invitations, quota and billing notices, and tips and product news for those who subscribed.

Stripe, Inc. (USA / Stripe Payments Europe Ltd., Ireland) — payments as merchant of record. Purpose: subscriptions, invoices, tax. Stripe sees billing contact and payment data, never document data.

IONOS SE (Germany) — the server our mailboxes run on. Purpose: email correspondence with customers, support requests included. The same server holds the website’s cookie-free statistics, which contain no customer data.

Operations

Sentry (Functional Software, Inc., USA, EU data region) — error reporting without document contents.

Better Stack (Better Stack, Inc., USA) — uptime monitoring of public endpoints and the status page; no customer data.

Changes

Organisation owners receive an email at least 30 days before a sub-processor is added or replaced. The current list is always this page. Rendered documents and uploaded files are stored in the EU only, unless a workspace configures its own storage destination (bring your own storage): a copy of its outputs then goes to the bucket the customer chose, which is the customer's own and not a Formfeed sub-processor. What the edge caches is named under Cloudflare above. The providers above are engaged under GDPR-compliant agreements with standard contractual clauses where a transfer of account or billing data occurs.