Sub-processors
Version: 14 October 2026
List last updated: 5 November 2026
A sub-processor is a third party that Hyfo uses to handle customer data in order to provide Hyfo. This list is part of the Data Processing Addendum. It was drawn up from what the service itself calls. Where it does not say where a provider processes data, the table says [to be confirmed before launch]. Legal entity names, and the transfer safeguards for each provider, are also [to be confirmed before launch].
The column headed “When it is used” says whether the service uses the provider as part of its own features, or only when the customer connects it (or the provider of the service switches it on).
| Provider | What it is used for | Customer data involved | When it is used | Where it processes data |
|---|---|---|---|---|
| Vercel | Hosts the application and runs its scheduled jobs. Vercel Blob holds the files customers upload. | Everything the application handles in transit, and the files users upload (receipts, project documents, HR documents). | Part of the service itself | The application runs in London (lhr1). The private file store is in London. Where the off-site file backup is switched on, a second private store in Dublin, Frankfurt or London holds backup copies. One-off e-mail attachments sit briefly in a separate store: [to be confirmed before launch]. |
| Neon | Hosts the PostgreSQL database. | All the records customers keep in the service: projects, customers and contacts, quotes and invoices, timesheets, expenses, leave and HR records, incident reports, and the accounts of their users. | Part of the service itself | [to be confirmed before launch] |
| Clerk | Authentication: sign-in, sessions, user accounts and organisation membership. | Users' names, e-mail addresses, profile images, sign-in identifiers and which organisations they belong to. | Part of the service itself | [to be confirmed before launch] |
| Resend | Delivers e-mail sent by the service: invitations, notifications, quotes, invoices and reminders. The provider of the service can use its own SMTP mail server instead. | Recipient and sender addresses, the message and any attachments. | Part of the service itself | [to be confirmed before launch] |
| Anthropic | The AI model behind the in-app assistant, reading expense receipts and enquiry e-mails, meeting action items, report drafting and report checks. | What a user sends to an AI feature: the question, the receipt, e-mail, transcript or report text, and the records the assistant looks up to answer. Nothing is sent unless someone uses an AI feature. | Used only when the provider of the service has set up AI features, and only when a user uses one. | [to be confirmed before launch] |
| Microsoft (Microsoft 365) | Sign-in with a Microsoft account. When a customer connects it: SharePoint file storage, Outlook mailboxes and calendars, Teams meeting transcripts, profile photos, and the Teams and Outlook apps. | Sign-in identity. When connected: files in the customer's SharePoint, e-mail the customer's mailboxes send or sync, calendar events, meeting transcripts and profile photos. | Microsoft sign-in is one of the sign-in choices. Everything else only when the customer connects Microsoft 365. | Set by the customer's own Microsoft 365 tenant. |
| Intuit QuickBooks Online | Keeps the customer's accounting records in step with its own QuickBooks company. | Customer names and contact details, quotes, invoices, payments, supplier bills and expense records, and the connection's access tokens. | Only when the customer connects QuickBooks. | Set by the customer's own QuickBooks account. |
| Xero | Keeps the customer's customer and sales invoice records in step with its own Xero organisation. | Customer names and contact details, sales invoices and their lines and payment status, and the connection's access tokens. | Only when the customer connects Xero. | Set by the customer's own Xero account. |
| Hyfo Field | The companion field data app. Projects and safety tasks are sent to it, and survey records are read back. | Project names and numbers, site details, assigned staff, safety tasks and the field records collected. | Only when the customer links its organisation to Hyfo Field. | Operated by the provider of the service. Location: [to be confirmed before launch]. |
| HubSpot | A customer can send company and contact records from HubSpot into the service through its own API key and an automation tool. The service does not connect out to HubSpot. | Company and contact records the customer chooses to send. | Only when the customer sets up the connection. | Set by the customer's own HubSpot account. |
| Google Maps Platform | The route picker and route map on mileage claims. The user's browser loads Google's map scripts directly. | The postcodes of the journey's stops, and the browser's IP address. | Only when the provider of the service has set up a Maps key. Without it, mileage is entered by hand. | [to be confirmed before launch] |
| Google sign-in (through Clerk) | Sign-in with a Google account. | Sign-in identity. | Only when the provider of the service has switched Google sign-in on. | [to be confirmed before launch] |
| postcodes.io | Turns postcodes into map coordinates, and the reverse, for site locations, journey stops and the subcontractor map. | Postcodes and coordinates. A subcontractor's postcode can be a home address. | Part of the service itself | [to be confirmed before launch] |
| Open-Meteo | Weather forecasts for scheduled site work. | Site coordinates only. | Part of the service itself | [to be confirmed before launch] |
| Companies House | Looks up a company's registered name and address when a user adds a customer or supplier. | The company name or number a user searches for. | Only when the provider of the service has set up a Companies House key. Otherwise OpenCorporates is used. | [to be confirmed before launch] |
| OpenCorporates | The company lookup used when there is no Companies House key. | The company name or number a user searches for. | Only when no Companies House key is set up. | [to be confirmed before launch] |
| Clearbit | Finds a company's logo and name suggestions from its website address when a user adds a customer. | A website address or company name a user types. | Part of the service itself | [to be confirmed before launch] |
| DiceBear | A generated picture for a user who has no profile photo. | The user's internal identifier (not their name or e-mail address), and the browser's IP address. | Part of the service itself | [to be confirmed before launch] |
| OpenStreetMap and Esri | Map tiles and place search in the browser: the site map on the client set-up form and the subcontractor map. | The area of the map being viewed, a place or postcode a person searches for, and the browser's IP address. | Part of the service itself | [to be confirmed before launch] |
| Browser push services (Apple, Google, Mozilla and Microsoft) | Delivers push notifications to the devices of people who turn them on. | The notification title and text, sent to the push service of the person's browser. | Only when the provider of the service has set up push notifications and a user turns them on. | Set by the browser vendor. |
Tools a customer sets up itself
A customer can link its own tools to the service with the API key it creates in Settings, for example Zapier or n8n, or paste a link from another service. Those tools are the customer's own choice and are not our sub-processors.
What the service does not use
The service does not use advertising or analytics providers. See the cookie notice.
How to be told about changes
We will tell customers before we add or replace a sub-processor, as the Data Processing Addendum says. To be told, e-mail hello@hyfo.uk with the subject “Sub-processor notices” and we will add your address to the list. How we notify customers who have not asked, and how far ahead: [to be confirmed before launch].