Updated 8 July 2026
JKOVE Oy (Business ID 3111634-8) uses the following sub-processors to provide the Flovei service. Each sub-processor is bound by a data processing agreement imposing data protection obligations equivalent to those set out in our Data Processing Addendum.
Supabase, Inc.
Role: Database and user authentication
Location: Data stored in the EU (AWS region eu-north-1, Stockholm, Sweden); company based in the United States
Transfer mechanism: Data residency in the EU; the Standard Contractual Clauses (2021/914) incorporated in Supabase's DPA apply to any access from outside the EU/EEA and to Supabase's own sub-processors
Vercel, Inc.
Role: Hosting platform, content delivery and serverless functions
Location: Server functions in the EU (Stockholm region); static content via global edge network; company based in the United States
Transfer mechanism: EU-U.S. Data Privacy Framework (primary); Standard Contractual Clauses (fallback)
Resend, Inc.
Role: Transactional email delivery (e.g. account and service emails)
Location: United States
Transfer mechanism: EU-U.S. Data Privacy Framework (primary); Standard Contractual Clauses (fallback)
Functional Software, Inc. (Sentry)
Role: Error monitoring and application diagnostics
Location: Event data stored in the EU (Sentry EU data residency, Frankfurt, Germany); company based in the United States
Transfer mechanism: EU data residency; EU-U.S. Data Privacy Framework (primary) and Standard Contractual Clauses (fallback) apply to any access from the United States
Cloudflare, Inc. (Turnstile)
Role: Bot protection on public forms
Location: Global network
Transfer mechanism: EU-U.S. Data Privacy Framework (primary); Standard Contractual Clauses (fallback)
Personal data entered into the service by users is stored in the EU (Supabase, Stockholm), and error monitoring data is stored in the EU (Sentry, Frankfurt). Sub-processors do not store this data outside the EU/EEA; processing outside the EU/EEA is limited to ancillary functions as described above.
Our sub-processors maintain independent security attestations (such as SOC 2 reports), available from each provider.
In addition, if the user enables an optional third-party integration (such as a calendar provider or a professional network), data is exchanged with that provider on the basis of the user's own, revocable authorization. These providers act as independent controllers of their own services and are not sub-processors of JKOVE Oy.
We will update this page and inform account holders at least 30 days before adding or replacing a sub-processor. The customer may object to a change on reasonable data protection grounds as described in the Data Processing Addendum.