# Sub-processors (FluxeHRa)

**FluxeHRa** is a registered brand of **Foil Envie SAS**, a société par actions simplifiée (SAS) registered in France.

Customers should list these in their processing register / DPA annex. Regions reflect production configuration as of August 2026.

| Sub-processor | Purpose | Region (production) |
|---------------|---------|---------------------|
| Supabase | Database, Auth, Storage, Realtime | eu-west-1 (Ireland) |
| Vercel | Web application hosting & serverless APIs | dub1 (Dublin) |
| Axiom | Security SIEM telemetry (structured `SECURITY_EVENT` — authz, tenant isolation, RLS, auth failures, cron, webhook HMAC, SSRF blocks; no HR business payloads) | US East edge (`us-east-1.aws.edge.axiom.co`) |
| Cloudflare Turnstile (optional) | Anti-bot / anti-enumeration challenge for select auth flows when enabled | Cloudflare infrastructure (region depends on request routing) |
| Vercel Analytics / Speed Insights (optional) | Aggregated performance analytics for the marketing/app runtime (no employee HR payloads by design) | dub1 / Vercel services (aggregated) |
| Sentry (optional) | Application error monitoring if a Sentry DSN is configured | Region depends on Sentry processing |
| DocuSign Connect (optional integration) | Third-party e-signature when the organization chooses DocuSign instead of native Fluxehra e-signature; envelopes under the customer’s DocuSign Account ID (customer billing). FluxeHRa uses a platform Integration Key for JWT API access only. Connect webhooks HMAC-verified. | Region depends on DocuSign account |

Optional customer-configured processors (not FluxeHRa defaults):

- Customer SMTP provider (org IT Link)
- Customer OIDC IdP
- Customer SFTP / webhook endpoints for integration export (customer-operated; authenticated with per-integration `fx_…` API keys and HMAC signed with the same key)

**Not a sub-processor:** **Fluxehra e-signature** (native **eIDAS SES**, optional org **PAdES-B** integrity seal) runs inside the FluxeHRa stack (Supabase Storage + Vercel). No separate signature vendor / QTSP is engaged for that engine. It is **not** AES/QES. Standards sheet: `docs/esign-standards.md` (internal / SU Documentation).

**Product editions:** Full HR (`product_edition = full`) and E-Sign only (`esign_only`) share this hosting stack. Edition-specific DPA / Terms / AIPD packs are on the [Trust Center](/trust).

**No medical / health data** in the product. French **HDS** certification is **not required** for this scope and is **not** claimed.

Contact: contact@fluxehra.ai for DPA updates when the list changes.