Sub-processor Register
Effective Date: 3 July 2026 · Document Ref: HHQ-POL-SUBP-001
ABN 34 689 167 477 · ACN 689 167 477
Sub-processor Register
The third-party providers that process personal data on behalf of Handover HQ
Effective Date: 3 July 2026
Document Reference: HHQ-POL-SUBP-001
Classification: PUBLIC
Review Cycle: Updated as sub-processors change; reviewed at least annually
1. About This Register
Handover HQ Pty Ltd (ABN 34 689 167 477 · ACN 689 167 477) engages a small number of trusted third-party sub-processors to help deliver the Handover HQ platform. This register lists every sub-processor that may process personal data on our behalf, the purpose of the processing, the categories of data involved, and the hosting location. It supports our Privacy Policy and Data Processing Agreement, and mirrors the live list maintained in our Trust Centre.
For our full security posture, security controls, and compliance roadmap, visit our Trust Centre at handoverhq.com/trust (or handoverhq.ai/trust).
2. Current Sub-processors
The following sub-processors are authorised as at the Effective Date, listed in order of data sensitivity:
| Sub-processor | Purpose | Data Processed | Hosting Region | DPA |
|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database, authentication, row-level security | All personal data stored in the Service | Australia (AWS ap-southeast-2, Sydney) | View |
| OpenAI Inc. | AI interview evaluation, summarisation, sentiment analysis (GPT-4o / GPT-4o-mini) | Interview question text and transcribed answers (transient — not retained or used for training) | United States | View |
| ElevenLabs Inc. | Text-to-speech for the voice AI interview | Interview question text only — no answers transmitted | United States | View |
| Resend Inc. | Transactional and lifecycle email delivery | Recipient email addresses, names, handover status notifications | United States | View |
| Sentry (Functional Software, Inc.) | Error monitoring and observability | Exception traces, request paths, user identifiers (no personal data payloads) | United States / European Union | View |
| Vercel Inc. | Frontend hosting and edge delivery | Technical data (IP, headers); no personal data stored at rest | Global edge network (Sydney POP) | View |
| Fly.io, Inc. | .NET application API hosting | Personal data in transit during API requests | Australia (Sydney region) | View |
3. Changes to Sub-processors
We provide at least 30 days’ advance notice before adding or replacing a sub-processor that processes personal data. Customers may object to a change on reasonable data-protection grounds as set out in our Data Processing Agreement.
To subscribe to sub-processor change notifications, email privacy@handoverhq.com / privacy@handoverhq.ai or security@handoverhq.com / security@handoverhq.ai.
4. Related Documents
5. Contact
Privacy Officer — Handover HQ Pty Ltd
Email: privacy@handoverhq.com / privacy@handoverhq.ai
Security: security@handoverhq.com / security@handoverhq.ai
Websites: handoverhq.com and handoverhq.ai