Legal
Subprocessors
Last updated 12 November 2026
These companies process personal data on our behalf to run ClockinBee. Each is under a written contract with data protection terms at least as strong as ours.
| Company | What they do | Data | Where |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, and the emails that confirm accounts and sign-in links. Hosted in London (AWS eu-west-2). | All customer data and account data, encrypted at rest | United Kingdom (AWS London, eu-west-2) |
| Amazon Web Services | The data centre Supabase runs on, in London. | The same data, encrypted; AWS staff can't read it in normal operation | United Kingdom (London) |
| Vercel Inc. | Hosts the website and app, in London, with a global network that delivers pages quickly. | Each request as it passes through, and short-lived technical logs (IP address, browser, page requested) | United Kingdom (London) for the app; global network for delivering pages |
| Anthropic (only if your company switches on the assistant's chat) | Answers questions an admin types into the assistant, using the Anthropic account and key your own company provides. | The question typed and the company records needed to answer it (for example who is working, shifts, time off requests). Sent only when an admin uses the chat. Pay rates and payslips are never sent. | United States |
| OpenStreetMap Foundation | Map pictures and address search when an admin places a location on the map. | The map area viewed and any address typed into the search box, with the admin's internet address. No staff data. | United Kingdom and the OpenStreetMap server network |
| Stripe Payments Europe, Ltd. | Takes card payments, issues invoices and runs the billing portal. | Billing contact, company name and address, card details (we never see full card numbers) | European Union and United States |
| Resend, Inc. | Sends our emails: notifications, reminders, and account emails such as welcome and trial messages. | Name, email address and the content of each email | United States |
Systems a customer chooses to export to, such as their payroll or HR software, are not our subprocessors. The customer has its own agreement with those providers.
Changes
We'll update this page and tell customers at least 30 days before adding or replacing a subprocessor.