Fluxx Labs, Inc.

Trust starts with transparency.

Certifications, controls, subprocessors, and audit materials — everything procurement, security, and legal teams need to evaluate Fluxx, in one place.

Last updated 13 days ago

Subprocessors

The current list of third-party vendors involved in delivering Fluxx — what data they process, and where they're located.

Airbrake

Airbrake

This service collects and aggregates application error reports, stack traces, and runtime/environment metadata to detect, triage, alert on, and diagnose runtime errors and performance and availability issues in our services.

Processes: Application error metadata (error type, message, stack trace), timestamps, environment/runtime details (service name, version, host), request identifiers, limited request/context data (e.g., route, user-agent). May include user identifiers or other application-level identifiers only if those are present in error payloads sent by our systems.

US

AWS

Amazon Web Services

Amazon Web Services (AWS) provides cloud infrastructure and platform services including compute, storage, networking, databases, managed platform services, and developer tools. We use AWS to host and run our applications, store and process data, and ensure scalable, reliable, and secure cloud operations.

Processes: May process customer data stored or transmitted through our systems, including: Account and user data (e.g., names, emails, IDs); Application data and content uploaded by users; Usage and log data (e.g., IP addresses, device/browser info); System and application logs, configuration and deployment metadata, backups; Operational telemetry and metrics, network and routing metadata, and CI/CD artifacts.

global · US

Datadog

Datadog

This service is used as a Security Information and Event Management (SIEM) system — it ingests, aggregates, and analyzes security-relevant logs, events, and alerts to detect threats, correlate incidents, support investigations, and retain audit trails.

Processes: May process security and audit logs, authentication and access events, system and application logs, network and firewall events, timestamps, host/container identifiers, alert metadata, and threat-detection telemetry; may also contain application-level or limited user identifiers if included in logged events.

US

Domo

Domo

As an optional add‑on, Domo provides business intelligence and data‑visualization tools to aggregate, transform, and present operational and analytics data for customer-facing reports, dashboards, and data‑driven decision making.

Processes: May process aggregated business metrics, analytics datasets, KPIs, CSVs and uploaded data extracts, user and account metadata (e.g., names, emails, roles), usage and access logs, dashboard configurations, and query results; may also process application-level data or limited user identifiers if uploaded to dashboards.

global · US

GCP

Google LLC

Google Cloud Platform (GCP) provides cloud infrastructure and platform services including compute, storage, networking, databases, and machine learning. We use GCP to host and run our applications, store and process data, and ensure scalable, reliable, and secure cloud operations.

Processes: May process customer data stored or transmitted through our systems, including: Account and user data (e.g., names, emails, IDs) Application data and content uploaded by users Usage and log data (e.g., IP addresses, device/browser info) Metadata related to system performance and interactions Let me know if you want this tailored to your specific use case (e.g., only hosting vs. analytics, or stricter data classification).

us-centra-1 · US

Microsoft Azure

Microsoft Corporation

Azure provides supplemental database infrastructure used only for secondary/replica databases for analytics and reporting, hosting and managing the datasets needed for customer analysis and aggregated reporting.

Processes: May process limited system and application data replicated for analytics purposes, including database records, aggregated query results, backups, metadata about datasets, timestamps, and identifiers necessary for linking records; does not host primary production workloads.

global · US

New Relic

New Relic

New Relic provides application performance monitoring and observability to collect telemetry, traces, and metrics for diagnosing performance issues and enhancing reliability and operational efficiency.

Processes: Processes application and infrastructure metrics, distributed traces, error reports and stack traces, transaction and request metadata, host/container identifiers, deployment and service metadata, timestamps, and alerting events; may also contain limited application-level or user identifiers if included in telemetry.

global · US

Pendo

Pendo

This service provides product analytics and in-app guidance tools to track user interactions, collect feature usage metrics, and deliver in-app messages, walkthroughs, and feedback mechanisms to improve product experience and adoption.

Processes: Processes event-level product usage data (page/views, feature interactions, click events), user and account metadata (e.g., user IDs, names, emails, roles if provided), device and browser information, session timestamps, survey/feedback responses, and aggregated analytics reports; we restrict and configure Pendo to avoid capturing sensitive fields.

US

Programmers.io

Programmers.io India Private Limited

This service provides development contracting and dedicated engineering resources: contracted engineers based in India work as integrated members of our product teams to design, develop, and maintain our software.

Processes: May access and process project-related code, development artifacts, technical documentation, test data, bug reports, deployment scripts, and limited personnel metadata (e.g., names, contact details, role) necessary to perform development work; access is provisioned and monitored under our contractor controls.

IN

Rackspace

Rackspace Technology

Rackspace provides email relay/SMTP services used solely to send transactional and system emails on our behalf.

Processes: May process outbound email headers and content (transactional messages, system notifications), recipient addresses, delivery and bounce metadata, timestamps, and delivery logs; we limit use to non-marketing transactional emails and avoid sending sensitive content through the relay.

US

Workato

Workato

Workato provides integration and automation platform-as-a-service (iPaaS) used to connect, orchestrate, and automate data flows between our applications and third-party systems to streamline workflows and operational processes.

Processes: May process integrated application data, event payloads, API requests/responses, transformation mappings, authentication metadata (e.g., service accounts, tokens), timestamps, and logs of automated actions; we configure recipes to limit data scope and avoid including sensitive fields where possible.

global · US

Zipdev

Zipdev

This service provides development contracting and dedicated engineering resources: contracted engineers based in South America work as integrated members of our engineering teams to design, develop, and maintain our software.

Processes: May access and process project-related code, development artifacts, technical documentation, test data, bug reports, deployment scripts, and limited personnel metadata (e.g., names, contact details, role) necessary to perform development work; access is provisioned and monitored under our contractor controls.

South America