Subprocessors
Last updated: 7 August 2026
Hexense Tech OÜ uses the following subprocessors to provide the Hexense HR service, as authorized under clause 5 of our Data Processing Agreement. We will update this page and notify Customers at least 30 days before adding or replacing a subprocessor that processes Customer Data.
| Subprocessor | Purpose | Location of processing |
|---|---|---|
| Supabase Inc. | Database, authentication, and file storage | EU — AWS eu-west-1 (Ireland) |
| Vercel Inc. | Application hosting, compute, and content delivery | EU compute region (Dublin); global CDN for static assets |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | EU / United States (Data Privacy Framework, SCCs) |
| Resend, Inc. | Transactional email (notifications, invites) | United States (Data Privacy Framework, SCCs) |
| Slack Technologies, LLC (Salesforce) | Optional integration: leave notifications and approvals in your Slack workspace (member names, work emails, leave types and dates) | United States (Data Privacy Framework, SCCs) |
| Cloudflare, Inc. (Turnstile, R2) | Anti-bot verification on public forms — careers applications and anonymous whistleblowing reports (browser interaction signals and IP address, processed transiently to distinguish people from automated submissions; not stored with submissions). Separately, encrypted off-site backup of files uploaded to the Service (employee documents, signed documents, expense receipts, candidate CVs, avatars and organisation logos), retained on a rotation schedule | Turnstile: global edge network, EU/US (Data Privacy Framework, SCCs). R2 backup storage: EU jurisdiction |
| Anthropic, PBC | Processing of support and bug-report tickets submitted through the in-app help center (ticket subject, description, and technical diagnostics) by an AI agent that triages issues and drafts fixes; API inputs are not used for model training and are subject to limited retention | United States (Data Privacy Framework, SCCs) |
| Functional Software, Inc. (Sentry) | Application error monitoring: when the Service encounters an error, the technical details (error type and message, stack trace, and the failing page or endpoint path) are sent for diagnosis and alerting. Error messages may incidentally include fragments of Customer Data present in the failing operation; request contents, cookies, and IP addresses are removed before sending, and the anonymous whistleblowing channel is excluded from error reporting altogether | EU (EU data-residency region) |
Some entries above cover optional integrations. Those vendors receive data only for organizations whose administrator has connected them, and stop receiving it as soon as the connection is removed. We list such a vendor before the integration becomes available, so that enabling it later never adds a subprocessor you weren’t already told about. A vendor appearing here is therefore not a statement that the corresponding integration is available to you today.
Questions about this list: privacy@hexense-hr.com