Subprocessors
Last updated: 26 July 2026
Hexense Tech OÜ uses the following subprocessors to provide the Hexense HR service, as authorized under clause 5 of our Data Processing Agreement. We will update this page and notify Customers at least 30 days before adding or replacing a subprocessor that processes Customer Data.
| Subprocessor | Purpose | Location of processing |
|---|---|---|
| Supabase Inc. | Database, authentication, and file storage | EU — AWS eu-west-1 (Ireland) |
| Vercel Inc. | Application hosting, compute, and content delivery | EU compute region (Dublin); global CDN for static assets |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | EU / United States (Data Privacy Framework, SCCs) |
| Resend, Inc. | Transactional email (notifications, invites) | United States (Data Privacy Framework, SCCs) |
| Slack Technologies, LLC (Salesforce) | Optional integration: leave notifications and approvals in your Slack workspace (member names, work emails, leave types and dates) | United States (Data Privacy Framework, SCCs) |
| Google LLC (Google Calendar) | Optional integration: approved leave on a shared team calendar you designate (member names, leave types and dates) | United States / EU (Data Privacy Framework, SCCs) |
| Cloudflare, Inc. (Turnstile) | Anti-bot verification on public forms — careers applications and anonymous whistleblowing reports (browser interaction signals and IP address, processed transiently to distinguish people from automated submissions; not stored with submissions) | Global edge network, EU/US (Data Privacy Framework, SCCs) |
| Anthropic, PBC | Processing of support and bug-report tickets submitted through the in-app help center (ticket subject, description, and technical diagnostics) by an AI agent that triages issues and drafts fixes; API inputs are not used for model training and are subject to limited retention | United States (Data Privacy Framework, SCCs) |
Some entries above cover optional integrations. Those vendors receive data only for organizations whose administrator has connected them, and stop receiving it as soon as the connection is removed. We list such a vendor before the integration becomes available, so that enabling it later never adds a subprocessor you weren’t already told about. A vendor appearing here is therefore not a statement that the corresponding integration is available to you today.
Questions about this list: privacy@hexense-hr.com