Sub-processors
Every sub-processor, what it does, where data is processed and its status.
Draft: this document is still being reviewed by a lawyer. Text in [square brackets] is a placeholder that will be filled in before the final version.
DRAFT v0.1 (2026-10-23). Not legal advice. Verify each provider's DPA, region and transfer mechanism before publication.
Last updated: 24 October 2026. This list is Annex 3 of the Data Processing Agreement. We notify Customers at least 30 days before adding or replacing a sub-processor (email to account owners + changelog on this page). Customers may object within that period (DPA art. 7).
Status: Live = processes Customer personal data today. Planned = contracted/intended, not yet live; will be activated only after notice.
A. Sub-processors for Customer data (TimeTracking = processor)
| Provider (entity) | Purpose | Data | Location of processing | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Supabase Inc. (US), on Amazon Web Services | Database, authentication, file storage (receipts, inbound attachments), backups | All Customer data | EU — Ireland (AWS eu-west-1) | Data stays in EU; Supabase Inc. is a US entity: EU SCCs (Module 3) + DPF where certified [verify] | Live |
| Vercel Inc. (US) | Web app hosting, serverless/edge functions, CDN | Data in transit through requests; request logs (IP, URL) | Functions: EU region (fra1/dub1) where possible. CDN edge: global | DPF + SCCs | Live |
| Anthropic (via Amazon Web Services EMEA SARL / AWS Bedrock) | AI extraction of emailed timesheets, anomaly detection, categorisation, translation, natural-language questions | Contents of inbound emails/attachments, hour entries, notes, names | EU — Frankfurt (AWS eu-central-1) | No transfer outside EU intended; AWS DPA + SCCs as fallback. No training on Customer data; no retention by model provider beyond processing [verify Bedrock terms] | Planned |
| Resend Inc. (US) | Transactional email (magic links, approval links, reminders) and inbound email routing | Name, email address, email content, links | [EU region if available — verify] | DPF + SCCs | Planned |
| Twilio Inc. (US) or MessageBird B.V. / Bird (NL) — DECISION OPEN | SMS / WhatsApp one-time codes and approval links | Phone number, message content (code/link) | Twilio: US/EU; Bird: EU | Twilio: DPF + SCCs. Bird: EU, no transfer | Planned |
| Functional Software Inc. — Sentry (US) | Error monitoring | Technical error data, may include user ID, IP, URL; PII scrubbing on | EU (Frankfurt, de.sentry.io) | DPF + SCCs (US entity) | Planned |
| Amazon Web Services EMEA SARL | Underlying infrastructure for Supabase and Bedrock (listed for transparency) | As above | EU | AWS DPA, SCCs | Live (via Supabase) |
| Apple Inc. / Google LLC | Push notifications (APNs, FCM) for nudges and clock reminders | Device token, notification text (kept minimal: no hours/names in payload) | Global | DPF + SCCs | Planned |
B. Processors for TimeTracking's own data (TimeTracking = controller)
Listed for transparency; these do not process Customer employee data.
| Provider | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Stripe Payments Europe Ltd. (IE) | Subscription billing, payment, tax calculation | Billing contact, company, VAT, payment method (held by Stripe) | EU/US | Stripe DPA, DPF + SCCs. Stripe acts as independent controller for payment/fraud data | Live |
| PostHog Inc. — EU Cloud | Website and product analytics (website: only after consent) | Pseudonymous IDs, page views, events; IP truncated | EU (Frankfurt) | DPF + SCCs (US entity) | Planned |
| Anthropic via AWS Bedrock | Mila, the AI support assistant | Support conversation content | EU — Frankfurt | As above | Planned |
| Google LLC (Workspace / Calendar) | Mila mailbox and meeting scheduling | Name, email, meeting times | EU/US | DPF + SCCs | Planned |
C. Not used
No advertising networks, no data brokers, no screenshot/keystroke tools, no separate OCR vendor.
Changelog
| Date | Change |
|---|---|
| 24 October 2026 | First version |