1. What a subprocessor is
A subprocessor is a vendor that processes personal data on our instructions to help us deliver Hi Networking. We use as few as possible and choose providers that operate in the European Economic Area or that offer a lawful transfer mechanism under Chapter V of the GDPR.
2. Current subprocessors
The list below is generated from our live subprocessor registry.
| Vendor | Purpose | Country | Data shared | Safeguard | Reviewed |
|---|---|---|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, storage, realtime | Ireland (EU) | All application data at rest | EU region, DPA + SCCs where applicable | 2026-07-04 |
| Cloudflare, Inc. | Edge network, DDoS protection, CDN, DNS | Global (EU edge) | IP address, request metadata | SCCs, EU–US DPF | 2026-07-04 |
| Stripe Payments Europe, Ltd. | Payment processing for Pro subscriptions | Ireland (EU) / United States | Name, email, billing address, payment token | SCCs, EU–US DPF | 2026-07-04 |
| Resend, Inc. | Transactional and marketing email delivery | United States | Email address, message contents | SCCs, EU–US DPF | 2026-07-04 |
| Lovable AI Gateway (Lovable GmbH) | AI features: coaching, summaries, OCR, matching | European Union | User prompts, uploaded content processed transiently | EU region, DPA, no training on user data | 2026-07-04 |
| Google LLC (OAuth) | Google Sign-In authentication | United States | Email, name, avatar URL | EU–US DPF | 2026-07-04 |
3. International transfers
Where a subprocessor is located outside the EEA, transfers are protected by the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework. The exact safeguard is shown in the table above.
Vendor selection standards
We only onboard subprocessors whose own security program aligns to the frameworks below. See the Security page for full details.
- SOC 2 Type II standard: SOC 2 Type IIFramework · aligned
Controls mapped to the AICPA Trust Services Criteria for security, availability, and confidentiality.
- EU General Data Protection Regulation: GDPREU · in effect
Processing built around GDPR data-subject rights, lawful bases, and Article 32 security obligations.
- ISO/IEC 27001 information security standard: ISO/IEC 27001Framework · aligned
Information security controls aligned to the ISO/IEC 27001 Annex A control set.
4. Notifying you of changes
We keep this page in sync with our internal registry. When we onboard a new subprocessor that processes user personal data, we update this page and, for material changes, send an in-app notification and an email to account holders at least 14 days in advance so you can object.
5. Contact
Questions or objections: privacy@hinetworking.com. You can also open a formal privacy request from your Privacy rights section.