SUB-PROCESSORS

Sub-processors

Service providers and their processing roles, including sub-processors used for customer HR data.

Last updated: September 2026

These providers support the service in the roles described below. Where a provider processes customer personal data on our behalf, Article 28 GDPR requires a processor agreement. The DPA sets out our obligations for engaging providers, notifying account owners of intended changes and handling objections. Some providers also act as controllers for their own specified processing.

  • Hetzner Online GmbH (Cloud Database)

    Cloud infrastructure hosting the application PostgreSQL database

    HR app data
    Location
    Germany (EU)
    Registered address
    Industriestr. 25, 91710 Gunzenhausen, Germany
    Transfer mechanism
    EU service arrangement; onward processing is subject to the provider DPA and applicable Chapter V safeguards
    Categories of personal data
    • All personal data stored by the platform

  • Hetzner Online GmbH (Object Storage)

    S3-compatible storage for documents, avatars and exports

    HR app data
    Location
    Germany (EU)
    Registered address
    Industriestr. 25, 91710 Gunzenhausen, Germany
    Transfer mechanism
    EU service arrangement; onward processing is subject to the provider DPA and applicable Chapter V safeguards
    Categories of personal data
    • Document files
    • Avatar and cover images
    • GDPR data exports

  • Mistral AI

    AI inference for the HR assistant, setup-wizard content generation, onboarding suggestions, document analysis, review and employment-reference drafting, and requested text translations

    AI inference
    Location
    EU and EFTA data centres
    Registered address
    15 rue des Halles, 75001 Paris, France
    Transfer mechanism
    EU service arrangement; onward processing is subject to the provider DPA and applicable Chapter V safeguards
    Categories of personal data
    • AI prompts and responses
    • Employee and review context assembled by AI features, submitted document content and text supplied for translation
    • Setup-wizard owner name and company description

  • ONLINECITY.IO ApS (GatewayAPI)

    Transactional SMS delivery for account recovery: backup-number verification codes and two-factor reset alerts.

    SMS delivery
    Location
    Denmark (EU)
    Registered address
    Buchwaldsgade 50, 5000 Odense C, Denmark
    Transfer mechanism
    GatewayAPI EU service arrangement; see the EU DPA for processing and routing terms
    Categories of personal data
    • Recipient phone number
    • SMS message content (verification codes, security alerts)

  • Brevo (Sendinblue SAS)

    Transactional email delivery (welcome, magic-link, notifications, billing, contact and support)

    Email delivery
    Location
    France (EU)
    Registered address
    7 rue de Madrid, 75008 Paris, France
    Transfer mechanism
    EU service arrangement; onward processing is subject to the provider DPA and applicable Chapter V safeguards
    Categories of personal data
    • Recipient email address
    • Recipient first name
    • Email subject and body content

  • Stripe Payments Europe Limited

    Subscription billing, payment processing, invoicing and tax collection

    Billing data
    Location
    Ireland (EU), with international processing including the United States
    Registered address
    1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
    Transfer mechanism
    Stripe Data Transfers Addendum: applicable adequacy arrangements and/or Standard Contractual Clauses, with required safeguards
    Categories of personal data
    • Account owner name and email
    • Billing address and VAT identifier
    • Payment method tokens (no raw card data on PersoHR systems)
    • Payment, transaction, device and IP information collected directly by Stripe

  • Plausible Insights OÜ

    Cookieless analytics for public website, app authentication and legal pages, plus server-side checkout and payment events. Authenticated workspace pageviews are not sent.

    Web analytics
    Location
    Provider in Estonia; analytics hosting in the EU
    Registered address
    Västriku tn 2, 50403 Tartu, Estonia
    Transfer mechanism
    EU service arrangement; onward processing is subject to the provider DPA and applicable Chapter V safeguards
    Categories of personal data
    • Transient IP processing to generate daily identifiers; raw IP addresses are not stored
    • Page URL and HTTP referrer
    • User agent string
    • Daily visitor identifiers without analytics cookies or cross-day identifiers
    • Subscription events: plan, billing cycle, amount and checkout company country; no names, email addresses or tenant identifiers in these event payloads

Customer-selected integrations are distinct from providers engaged by PersoHR. Before enabling an integration, review the data it receives, its processing terms and any international transfers. Runtime text-translation requests use the AI provider listed above.

The DPA's required notices of intended sub-processor additions or replacements are sent to account owners; they do not depend on subscribing to this page. Other interested people may request updates at privacy@persohr.eu.