Subprocessors
Draft — pending review by a solicitor. Not yet in force.
The companies that process personal data on Fyle's behalf, what each does, what data it handles and where. Planned providers are marked; they will only process customer data once they are live and listed as in use.
Last updated
1.Current and planned subprocessors
| Provider | Purpose | Personal data | Location | Status |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting the website and web app (Workers), DNS, TLS, and object storage for file content (R2). Planned: cookieless web analytics. | Web requests (IP address, browser details, URLs). File content and versions stored in R2, encrypted at rest. Account and session data in transit. | Global edge network for web requests. R2 storage region for Fyle-managed workspaces: to be confirmed (R2 places a bucket by location hint or jurisdiction). | In use |
| Neon | Managed PostgreSQL database: accounts, organisations, sessions and file metadata. | Account details (name, email), organisation membership and roles, session records (IP address, browser, device), file and folder names, version history and audit records. | United Kingdom (AWS eu-west-2, London). | In use |
| Resend | Sending transactional email (sign-in links, verification, invitations, security and billing notices). | Recipient name and email address, email content. | United States. | In use |
| Stripe | Taking payments, subscriptions, invoices and tax calculation (Stripe Tax). | Billing name, email and address, VAT number, payment card details (collected by Stripe; Fyle never sees full card numbers), invoices. | United Kingdom, European Union and United States. | Planned |
| Hetzner Online GmbH | Hosting the Fyle API servers that coordinate files, versions and sync. File bytes do not pass through them. | API requests (IP address, account and device identifiers), file and folder metadata in transit. | Germany or Finland (Hetzner has no UK region). | Planned |
2.Services that don't receive personal data
- Have I Been Pwned (Pwned Passwords API, api.pwnedpasswords.com)
- When you set a password we check it has not appeared in a known data breach. Only the first 5 characters of the password's SHA-1 hash are sent; the password itself and the full hash never leave our servers.
3.Your own storage
Enterprise customers who bring their own S3-compatible bucket choose and contract with that storage provider themselves. That provider is the customer's own supplier, not Fyle's subprocessor, and file content in that bucket stays in the location the customer chose.
4.Changes to this list
We will update this page and email account owners of team and Enterprise organisations at least 30 days before a new subprocessor starts processing customer data, so they can object under our data processing agreement. To ask a question or object, email privacy@fyle.sh.