Subprocessors
Who else processes data, and what for.
FloorPilot uses a limited number of providers to deliver the service. Below is who they are, what they are used for and which data may be involved. This list belongs with the data processing agreement; changes are announced in advance.
As of 4 October 2026
| Provider | Used for | Which data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage. The core of the data lives here. | Accounts, organisations, events, documents, incidents, municipality files, audit log | Ireland (eu-west-1) |
| Vercel | Hosting of the web application. | Request data and the content as served | Frankfurt (fra1) |
| Resend | Sending email: invitations, notifications, reports. | Email addresses and the content of the message | EU-US, see below |
| Anthropic | AI suggestions for documents and templates. Advice, never a decision. | The document context needed for the task, after redacting email addresses, phone numbers and identifiers | EU-US, see below |
| Sentry | Error reports from the application, so outages are noticed. | Error data and limited request context | EU-US, see below |
| Twilio | Emergency text messages. Not a standard channel, fallback only. | Phone numbers and the content of the text message | EU-US, see below |
| Postmark | Inbound email on a municipality file, only when configured. | Forwarded email and attachments | EU-US, see below |
Core data stays in the EEA
The database, the documents and the accounts sit within the European Economic Area: Supabase in Ireland (eu-west-1) and Vercel in Frankfurt (fra1). For providers with a United States component, transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.
Changes
If a provider is added or dropped, we notify every organisation with an active data processing agreement before the change takes effect. You may object; this is set out in article 4 of the agreement.
What we do not claim here
- None of the providers above means FloorPilot is certified. We hold no ISO 27001 and no NEN 7510, and we do not claim either.
- Each provider's signed data processing agreement is reviewed at the start of the first pilot and added to the file. Where that has not happened yet, it is stated with the provider.
- This list only contains providers actually in use. Parties once considered or tested are not on it.
What FloorPilot does not use
- DigiD and eHerkenning
- not connected
- Dutch case management (ZGW) and Common Ground
- no integration
- Advertising or tracking networks
- none, the site sets no tracking cookies
Questions about this list go to privacy@wearefloorpilot.com
Schedule an introduction call