Subprocessors
Last updated: April 20, 2026
These are the third-party services we use to operate Mistflow. We keep this page up to date so you always know who touches your data.
Infrastructure and Platform
| Subprocessor | Purpose | Data processed |
|---|
| Cloudflare |
App hosting (Workers, Pages), artifact storage (R2), DNS, CDN, edge logging |
Build artifacts, HTTP request logs, IP addresses, user agents |
| Microsoft (Azure) |
Backend VM compute, Azure Key Vault for master encryption key |
API request data, encrypted project state, master key material |
Databases for Your Apps
| Subprocessor | Purpose | Data processed |
|---|
| Neon |
Managed Postgres for apps on the Postgres tier; isolated branches for staging previews |
Whatever your app stores in its database |
| Turso |
Managed SQLite (libSQL) for apps on the SQLite tier |
Whatever your app stores in its database |
Authentication
| Subprocessor | Purpose | Data processed |
|---|
| Clerk |
Authentication, user management, organization memberships |
Email, name, profile fields from social providers, auth session metadata |
AI
| Subprocessor | Purpose | Data processed |
|---|
| Anthropic |
Technical plan generation when you call mist_plan |
Your app description and answers to discovery questions. Processed under Anthropic's zero-retention commercial API terms; not used to train models. |
Billing, Email, Analytics
| Subprocessor | Purpose | Data processed |
|---|
| Dodo Payments |
Payment processing, subscription management, webhook-driven billing state |
Email, billing address, last 4 of card (full card stays with Dodo), subscription metadata |
| Resend |
Transactional email (deploy notifications, invites, receipts) |
Email address, message content, delivery metadata |
| PostHog |
Product analytics, uncaught backend exception capture |
User ID, org ID, event names and properties, scrubbed stack traces |
| Sentry |
Error tracking for the dashboard and backend |
Scrubbed stack traces, request context, user ID |
Optional Integrations for Your Apps
These services only receive data when a user app you build explicitly enables them. Mistflow itself does not send your personal data to these providers.
| Subprocessor | Purpose |
|---|
| Google (Places API) | Location search for apps that opt in to maps features |
| Unsplash | Stock imagery embedded into generated landing pages |
Questions
Questions about this page: [email protected].