Subprocessors

Third-party services that process data on behalf of HiveFlow. All subprocessors have executed Data Processing Agreements (DPAs) with HiveFlow.

Last updated: May 18, 2026 · Subscribe to security@hiveflow.ai for change notifications.

SubprocessorPurposeData ProcessedLocationDPA
Amazon Web Services (AWS)Object storage (S3), LLM inference (Bedrock)User files, LLM prompts/responsesUS West (Oregon, us-west-2)
MongoDB AtlasPrimary databaseUser accounts, workflow definitions, execution history, encrypted credentialsAWS us-west-2 (dedicated cluster)
AnthropicLLM provider (Claude models)Workflow prompts and responsesUnited States
OpenAILLM provider (GPT models)Workflow prompts and responsesUnited States
Google CloudLLM provider (Gemini), OAuth authenticationWorkflow prompts, OAuth tokensUnited States
RailwayBackend API hostingAll API traffic (processing only, not storage)US West
VercelFrontend static hosting, CDNStatic assets only — no client data storedGlobal Edge Network
Redis (managed)Session cache, real-time stateSession tokens, temporary execution stateCo-located with backend
E2BSandboxed code executionUser code, execution inputs/outputsMulti-region
GitHubOAuth provider, source code hostingOAuth tokens, user profile (name, email)United States

Data Flow Principles

Orchestration vs. Processing

HiveFlow orchestrates workflows — it routes data between services but minimizes persistent storage. Client credentials are encrypted at rest and decrypted only in-memory during execution.

LLM Data Handling

When using customer-provided API keys, prompts are sent directly to the LLM provider. HiveFlow tracks token usage for billing but does not persist prompt/response content in logs.

No Training on Your Data

HiveFlow does not use customer data to train models or improve services. Your workflows, documents, and execution results belong to you.

Notification of Changes

We provide 30 days advance notice before adding new subprocessors. Enterprise customers can object to changes per their DPA terms.