Sub-processors
Last updated 2026-10-22. Draft: pending review by a qualified lawyer.
These are the providers that process personal data on behalf of Zetta HR customers. We bind each one by a written data processing agreement. We will give customers at least 30 days’ notice by email before adding or replacing a sub-processor that handles customer content, and customers may object as set out in the DPA. Some services are not yet in use; the table is updated as each goes live.
| Provider | Purpose | Data | Location | Their terms |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting and running the application, private document storage, queues, network security and DNS | All customer content in transit and document files at rest; request metadata including IP addresses | Global edge network; document storage in the EU; application code runs at the edge | DPA Their sub-processors |
| Supabase, Inc. | Managed Postgres database and user authentication | All structured customer records; account and sign-in data | United Kingdom (London) | DPA Their sub-processors |
| Stripe Payments UK Ltd / Stripe, Inc. | Subscription billing and payment processing | Billing contact, organisation name, subscription status; card details are handled by Stripe directly | UK, EU and United States | DPA Their sub-processors |
| Resend, Inc. | Delivery of service emails (reminders, notifications) | Recipient name and email address and the content of the email | United States / EU region as configured | DPA Their sub-processors |
Transfers
Where a provider or its sub-processors process data outside the UK, the transfer is covered by a UK adequacy regulation or by the UK International Data Transfer Agreement or the UK Addendum, as described in each provider’s DPA.