# Heyflow

Heyflow (heyflow.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/heyflow
- Documents last verified: 2026-10-03
- Transparency rating: 72/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 7 tracked vendors directly, 92 within two hops, 298 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: Heyflow, Third Party Index, https://thirdpartyindex.com/vendors/heyflow (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.heyflow.com/ | 2026-10-03 | 2026-10-03 |
| Subprocessor list | https://trust.heyflow.com/subprocessors | 2026-10-03 | 2026-10-03 |
| Privacy policy | https://heyflow.com/legal/data-privacy/ | 2026-10-03 | 2026-10-03 |
| Terms | https://heyflow.com/legal/terms-and-conditions/ | 2026-10-03 | 2026-10-03 |
| Status page | https://status.heyflow.com/ | 2026-10-03 | 2026-10-03 |

## Subprocessors (9)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Feature-based: Only active if e-email functionalities are activated; Sending request data by e-mail to Customer | EU | 2026-10-03 |
| [Anthropic](https://thirdpartyindex.com/vendors/anthropic.md) (AI model provider: Anthropic) | Engineering; Powers Heyflow's own AI assistant and other AI-assisted features generating AI Output | US | 2026-10-03 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | Cloud monitoring; Content delivery, security, DNS, and abuse prevention 2. Manages SSL certificates and connections for custom domains | Global | 2026-10-03 |
| [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Cloud provider; Google Cloud Platform to provide and operate the servers | EU | 2026-10-03 |
| [OpenAI](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | Engineering; Powers Heyflow's own AI assistant and other AI-assisted features generating AI Output | EU | 2026-10-03 |
| [Sinch Sweden AB](https://thirdpartyindex.com/vendors/sinch.md) | Feature-based: Only if SMS verification feature is activted; Sending one-time passcodes for SMS verification (optional functionality) | EU | 2026-10-03 |
| [Tinybird](https://thirdpartyindex.com/vendors/tinybird.md) | Providing functionalities of the Heyflow Analytics dashboard; Real-time data processing to enhance querying and visualization of flow analytics Supports analytics dashboard functionality | US | 2026-10-03 |
| Trestle Solutions, Inc. | Feature-based: Only active if phone number verification feature is used; Phone number verification (optional functionality) | US | 2026-10-03 |
| tyntec Ltd. | Feature-based: Only active if phone number verification service is used; Phone number verification (optional functionality) | EU / UK | 2026-10-03 |

Read from ([evidence](https://thirdpartyindex.com/evidence/36532)). CSV: https://thirdpartyindex.com/vendors/heyflow/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 2. All vendors that list one: https://thirdpartyindex.com/ai

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II, ISO/IEC 27001 ([evidence](https://thirdpartyindex.com/evidence/36531))
- Claimed: HIPAA, GDPR ([evidence](https://thirdpartyindex.com/evidence/36531))

## Subprocessor of (0)

No tracked vendor lists it.

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api