Roles
Dealership = Controller. Flash Fender = Processor. For voice and analytics workloads, sub-processors are listed at /legal/sub-processors with 30-day change notice.
Scope
Processing categories: account, usage telemetry, tenant data (entered by the dealership), voice (only if opted in). Categories of data subjects: end-customers of the dealership, dealership employees, prospects in CRM.
Sub-processor list
Cloudflare (hosting), Stripe (payments), Resend (email), ElevenLabs (voice), PostHog Cloud (analytics). A signed DPA is on file with each.
Transfers
Primary processing in US/EU depending on tenancy. SCCs in place for cross-border transfers. DPA includes the EU Commission's 2021 Standard Contractual Clauses by reference.
Security measures
TLS 1.3, AES-256 at rest, per-tenant KMS keys, audit chain, MFA enforced for Owner and GM roles.
DSAR assistance
We provide tooling in the Privacy Console for tenant-side DSAR requests. We don't see what you don't enter; we're not the custodian of your customer PII.
Audits
You can request a copy of our latest SOC 2 Type II report under NDA. Material incidents are notified within 72 hours.
How to countersign
Email legal@flashfender.com with 'DPA countersign' in the subject. We e-sign within 2 business days.
Looking for something specific? Email legal@flashfender.com — we read everything within 2 business days.