Data privacy and sub-processors
Where Qualflare stores customer data, which sub-processors handle it and for what, how you hear about a new one before it starts, and how to accept the DPA.
Last updated
Qualflare stores customer data in the European Union, in Google Cloud's europe-central2 region in Warsaw, Poland; this page lists the sub-processors that handle it, by function and location, and how you hear about a new one at least 30 days before it starts.
Where your data is stored
Qualflare's application servers and primary PostgreSQL database run in Google Cloud's europe-central2 region in Warsaw, Poland. Cloudflare provides object storage and edge services with EU-region routing. Qualflare doesn't store customer data outside the European Economic Area (EEA) in the ordinary course of running the service.
When personal data leaves the EEA, the transfer relies on the EU-US Data Privacy Framework, the European Commission's 2021 Standard Contractual Clauses or an adequacy decision, as section 9 of the Privacy Notice describes.
Sub-processors
Qualflare's sub-processors are the companies that process customer personal data for Qualflare, and the Data Processing Addendum (DPA) lists them. This table summarizes its Annex 3, Version 2026.10, last updated 25 October 2026.
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud | Application hosting, the primary PostgreSQL database, logs and scheduled tasks | European Union: europe-central2, Warsaw, Poland |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, web application firewall, object storage (R2), AI Gateway, Clef on Workers AI, email delivery | Global edge network with EU-region routing; core data planes primarily in the United States |
| Google LLC (Gemini API) | Prompts and outputs of Qualflare's AI features | United States and other regions where Google operates |
| Amplitude, Inc. | Product analytics and session replay in the Qualflare app | European Union (api.eu.amplitude.com) |
| Stripe, Inc. | Billing, payments and invoicing | United States |
| Google LLC (Google Analytics 4 and Google Tag Manager) | Analytics on the qualflare.com marketing site only | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | United States |
| Microsoft Corporation (Microsoft Clarity) | Heatmaps and session replay on the qualflare.com marketing site only, after analytics consent | United States |
| Intercom, Inc. | Support chat | United States |
| LangWatch (Reasoning Engine B.V.) | AI observability: traces of prompts, completions and tool calls | European Union (EU data centers) |
| Raintank Inc. dba Grafana Labs (Grafana Cloud) | Application logs and operational metrics | European Union (prod-eu-west-2); Grafana Labs states that data may be transferred to the United States |
| OpenAI | Quo, on workspaces Qualflare has enabled for it | United States |
Section 8 of the Privacy Notice also names recipients outside Annex 3 for the website and supporting services: Phare for the status page, Clerk for sign-in on the changelog site, and Google Workspace for Qualflare's mailboxes. The DPA's Annex 3 is the binding list.
How you hear about a new sub-processor
Qualflare gives at least 30 days' written notice before a new sub-processor starts processing customer personal data, through the sub-processor change record in section 8.7 of the DPA and, if you ask, by email. You can object on reasonable data-protection grounds by emailing legal@qualflare.com within those 30 days.
Accept the DPA
Creating a Qualflare account and accepting the Terms of Service already accepts the DPA, as section 20 of the DPA says. To accept it as a stand-alone instrument for your company, which replaces that acceptance, use the DPA's stand-alone acceptance form:
- Open the Acceptance section of the DPA.
- Fill in Company (Data Exporter) name, Company address, Contact person's name, Contact person's position and Contact email, select the box that confirms you're authorized to bind the company, and click Accept this DPA.
- Within 24 hours, open the link Qualflare emails to the contact, and confirm on the page it opens. Nothing is recorded until then, and the link works once.
- A receipt follows by email.
For enterprise customers that need a counter-signed document, Qualflare makes a PDF of the DPA available for signature on request.
Certifications
Qualflare holds no SOC 2 report or ISO 27001 certification. Qualflare's security controls are described against the CSA Cloud Controls Matrix v4.1 in its self-assessment: see the Shared Security Responsibility Model and the Control Ownership Map.
Related
AI and your data · Security and trust · Privacy Notice · Data Processing Addendum · GDPR at Qualflare · Report a vulnerability
Security and trust
How Qualflare stores and processes your data, splits security duties, owns each CSA CCM v4.1 control, handles incidents and takes vulnerability reports.
AI and your data
Which providers run Qualflare's AI features, what each one receives, what is redacted first, the no-training commitment and the switches that turn AI off.