FluxeHRa is a registered brand of Foil Envie SAS, a société par actions simplifiée (SAS) registered in France.
Customers should list these in their processing register / DPA annex. Regions reflect production configuration as of August 2026.
| Sub-processor | Purpose | Region (production) |
|---|---|---|
| Supabase | Database, Auth, Storage, Realtime | eu-west-1 (Ireland) |
| Vercel | Web application hosting & serverless APIs | dub1 (Dublin) |
| Axiom | Security SIEM telemetry (structured SECURITY_EVENT — authz, tenant isolation, RLS, auth failures, cron, webhook HMAC, SSRF blocks; no HR business payloads) |
US East edge (us-east-1.aws.edge.axiom.co) |
| Cloudflare Turnstile (optional) | Anti-bot / anti-enumeration challenge for select auth flows when enabled | Cloudflare infrastructure (region depends on request routing) |
| Vercel Analytics / Speed Insights (optional) | Aggregated performance analytics for the marketing/app runtime (no employee HR payloads by design) | dub1 / Vercel services (aggregated) |
| Sentry (optional) | Application error monitoring if a Sentry DSN is configured | Region depends on Sentry processing |
| DocuSign Connect (optional integration) | Third-party e-signature when the organization chooses DocuSign instead of native Fluxehra e-signature; envelopes under the customer’s DocuSign Account ID (customer billing). FluxeHRa uses a platform Integration Key for JWT API access only. Connect webhooks HMAC-verified. | Region depends on DocuSign account |
Optional customer-configured processors (not FluxeHRa defaults):
fx_… API keys and HMAC signed with the same key)Not a sub-processor: Fluxehra e-signature (native eIDAS SES, optional org PAdES-B integrity seal) runs inside the FluxeHRa stack (Supabase Storage + Vercel). No separate signature vendor / QTSP is engaged for that engine. It is not AES/QES. Standards sheet: docs/esign-standards.md (internal / SU Documentation).
Product editions: Full HR (product_edition = full) and E-Sign only (esign_only) share this hosting stack. Edition-specific DPA / Terms / AIPD packs are on the Trust Center.
No medical / health data in the product. French HDS certification is not required for this scope and is not claimed.
Contact: contact@fluxehra.ai for DPA updates when the list changes.