Subprocessors

Last updated: 17 August 2026

We use a small number of providers to deliver AssistHR. This page lists the ones that may process customer personal data, so you can see exactly who is involved.

This list supports our Data Processing Addendum. We only include providers that are verified as part of the current service.

Current subprocessors

Current AssistHR subprocessors, their purpose, the data involved and transfer information
Provider	Purpose	Relevant data	Transfers
Supabase, provided through Lovable Cloud	Database, authentication, server-side functions and file storage for the platform	Account and authentication data, all HR records the customer enters, uploaded documents, audit and system logs	Location depends on the project configuration. Where personal data leaves the United Kingdom, an appropriate transfer mechanism and safeguards apply
Lovable email service	Sending transactional email such as sign-in messages, invitations, confirmations and service notifications	Recipient name and email address, and the content of the message being sent	Location depends on provider configuration. Where personal data leaves the United Kingdom, an appropriate transfer mechanism and safeguards apply
Stripe	Subscription billing and hosted checkout	Billing contact details, subscription and payment status. AssistHR does not store card details, which are handled by Stripe in its hosted checkout	Stripe operates internationally. Where personal data leaves the United Kingdom, an appropriate transfer mechanism and safeguards apply
Lovable AI Gateway, using a Google Gemini model	Powering the HR Help assistant	Only the sanitised, allowlisted input the feature needs for the request, plus the prompt text the user writes. Whole HR records are not passed to the model	Model processing may take place outside the United Kingdom. Where that happens, an appropriate transfer mechanism and safeguards apply
Have I Been Pwned	Screening new and changed passwords against known leaked credentials	Only the first five characters of a SHA-1 hash of the password. The full password, the full hash, the email address and any other identifier are not sent	The service is accessed over the internet and may be operated outside the United Kingdom. No personal identifier is transmitted for this check

Locations and transfers

We do not state a fixed processing location for each provider, because the location depends on how the provider is configured for the relevant environment, and configurations can change.

Where personal data is processed outside the United Kingdom, we rely on a transfer mechanism recognised under UK data protection law, along with any additional measures the transfer requires. For the current arrangements that apply to your account, including specific locations and safeguards, contact info@assisthr.co.uk and we will confirm the position.

Authorisation and changes

Customers give general authorisation for us to use subprocessors, as set out in our Data Processing Addendum. In return we commit to the following:

each subprocessor is bound by data protection obligations substantially the same as ours, so far as they apply to the work it performs
we remain responsible to the customer for the performance of our subprocessors
we will update this page and notify affected customers of a new or replacement subprocessor before it begins processing customer personal data, or as soon as reasonably practicable where an urgent change is needed to keep the service running or secure
customers may object on reasonable data protection grounds, and we will work with them in good faith to find a solution as described in the Data Processing Addendum

To be told about changes, email info@assisthr.co.uk and ask to be added to subprocessor change notifications.

What is not on this list

We deliberately keep this list to verified providers of the live service. Some names sometimes appear in software projects without actually processing customer data, so we exclude them until that is confirmed:

A credential exists in the platform for an alternative email provider, but we have not verified a direct call to it in the service, so it is not listed as a confirmed subprocessor.
Voice and video generation tooling is only used for our own marketing content production. It does not process customer HR data, so it is not a subprocessor of customer data.

If either position changes, we will add the provider to the table above and notify customers as described in the previous section.

Contact us

Questions about our subprocessors: info@assisthr.co.uk